Insecure Credential Storage in UpSignOn for Windows
CVE-2026-75136

6.9MEDIUM

Key Information:

Vendor

Septeo It Solutions

Status
Upsignon
Vendor
CVE Published:
2 September 2026

What is CVE-2026-75136?

UpSignOn for Windows versions prior to 7.19.0 exhibit a vulnerability related to insecure credential storage. This flaw allows local attackers to exploit the Windows PasswordVault API and directly access the biometric unlock key without requiring any form of authentication. By executing a standard local process within an active Windows session, an attacker can decrypt protected vault files and gather sensitive password manager contents in plain text. This poses significant risks as attackers can obtain sensitive user credentials without detection.

Affected Version(s)

UpSignOn 0

References

https://upsignon.eu/en/resources/release-notes/app#7.19.0
release-notes
https://www.vulncheck.com/advisories/upsignon-biometric-k...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elymaro (Aurélien Bourdois)
.