CVE-2025-53139CWE-319

Windows Hello Security Feature Bypass Vulnerability

High · published October 14, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

⚡ Windows Hello has a surprisingly sneaky flaw, transmitting sensitive info in cleartext! This means an unauthorized attacker can bypass its security features right under your nose! 🔐 Think of it like sending a postcard instead of a sealed envelope. While the postcard is visible for anyone to read, the sealed envelope keeps your secrets safe. Unfortunately, Windows Hello is offering up postcards without a second thought! An attacker could locally access sensitive information, allowing them to bypass security protections that Windows Hello was designed to enforce. This could lead to unauthorized access to personal accounts or sensitive data, resulting in potentially devastating breaches of privacy and security.

Put simply

Think of it like sending a postcard instead of a sealed envelope. While the postcard is visible for anyone to read, the sealed envelope keeps your secrets safe. Unfortunately, Windows Hello is offering up postcards without a second thought! This vulnerability involves the cleartext transmission of sensitive information, enabling unauthorized users to bypass local security features of Windows Hello without proper authentication.

What to do

An attacker could locally access sensitive information, allowing them to bypass security protections that Windows Hello was designed to enforce. This could lead to unauthorized access to personal accounts or sensitive data, resulting in potentially devastating breaches of privacy and security. To mitigate this risk, ensure you update your Windows system to the latest version as soon as possible. Additionally, review your security configurations and consider implementing encrypted communication channels to safeguard sensitive data transmissions. You've got this! Patch up and secure your systems, and you'll be back to superhero status in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.7th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Windows Hello Security Feature Bypass Vulnerability
    cvelistv5