CVE-2025-26635: medium-severity vulnerability in Microsoft Windows 10 Version 1809
Windows Hello Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Windows Hello, Windows' facial recognition and fingerprint login system, has a weakness that allows someone with network access to bypass its security protections. This means an attacker could potentially log in as another user without proper authentication.
A weak authentication implementation in Windows Hello enables an authorized network attacker to circumvent the security feature, likely through replay attacks or improper validation of authentication tokens. Exploitation requires network-level access and valid initial authentication credentials to the system.
In the same product, most dangerous first.