What is GHSA-9pfj-rxxp-9cf2?

GHSA-9pfj-rxxp-9cf2 is a security advisory published by GitHub Security Advisories with Medium severity. UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that...

Which CVE IDs does GHSA-9pfj-rxxp-9cf2 cover?

GHSA-9pfj-rxxp-9cf2 covers the following CVE IDs: CVE-2026-75136. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9pfj-rxxp-9cf2?

GHSA-9pfj-rxxp-9cf2 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-9pfj-rxxp-9cf2MediumCVSS 6.1

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-75136 →

📋 Description

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-75136
https://upsignon.eu/en/resources/release-notes/app#7.19.0
https://www.vulncheck.com/advisories/upsignon-biometric-key-exposure-via-windows-passwordvault
https://github.com/advisories/GHSA-9pfj-rxxp-9cf2