CVE-2026-4522

MediumCVSS 6.7/10Last modified Jun 25, 2026

Description

Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception.

This issue affects HYPR Passwordless: before 11.1.1.

Metrics

CVSS 4.0 6.7/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-452217.8Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by plaCVE-2026-452226.1Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permCVE-2026-452238.8Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserTokCVE-2026-452247.1Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supplCVE-2026-452257.6Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-conCVE-2026-452267.1Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitraryCVE-2026-452278.8Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to CVE-2026-452285.4Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders puCVE-2026-452298.8Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrCVE-2026-45233.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 tCVE-2026-452309.1DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters tCVE-2026-452316.1DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, ser
CVE-2026-4522: Medium severity, CVSS 6.7 | Vulnix