CVE-2025-26644: Windows 10 1809 Auth Bypass Vulnerability

CVE-2025-26644 Overview

CVE-2025-26644 is a spoofing vulnerability in Windows Hello, Microsoft's biometric authentication system. The vulnerability stems from an automated recognition mechanism with inadequate detection or handling of adversarial input perturbations, which allows an unauthorized attacker to perform spoofing locally. This weakness enables attackers with physical access to bypass biometric authentication controls intended to secure Windows devices.

Critical Impact

An attacker who successfully exploits this vulnerability could bypass Windows Hello biometric authentication, potentially gaining unauthorized access to protected systems and sensitive data without proper credentials.

Affected Products

• Microsoft Windows 10 1809 (x64 and x86)
• Microsoft Windows 10 21H2
• Microsoft Windows 10 22H2
• Microsoft Windows 11 22H2
• Microsoft Windows 11 23H2
• Microsoft Windows 11 24H2
• Microsoft Windows Server 2019
• Microsoft Windows Server 2025

Discovery Timeline

• April 8, 2025 - CVE-2025-26644 published to NVD
• July 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-26644

Vulnerability Analysis

This vulnerability is classified under CWE-1039 (Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations). Windows Hello provides biometric authentication using facial recognition, fingerprint scanning, or iris recognition. The flaw exists in how the recognition mechanism processes and validates biometric input, failing to adequately detect adversarial perturbations that could be used to fool the authentication system.

The local attack vector means the attacker requires physical access to the target device. While this limits remote exploitation possibilities, it presents significant risks in scenarios involving stolen devices, shared workstations, or insider threats. The high complexity rating indicates that exploitation requires specific conditions or specialized knowledge to successfully bypass the biometric controls.

Root Cause

The root cause lies in the inadequate detection mechanisms within Windows Hello's automated recognition system. The biometric authentication fails to properly identify and reject adversarial inputs that are designed to manipulate the recognition algorithm. This could involve specially crafted images, 3D-printed masks, or other spoofing artifacts that exploit weaknesses in the liveness detection or pattern matching algorithms.

Attack Vector

The attack requires local access to the target system. An attacker must be physically present at the device and present adversarial biometric inputs to the Windows Hello sensors. The specific exploitation method involves crafting inputs that exploit gaps in the adversarial input detection, potentially using techniques such as presentation attacks against facial recognition or fingerprint spoofing.

The vulnerability affects the integrity of the authentication process, allowing unauthorized parties to authenticate as legitimate users without possessing valid biometric credentials.

Detection Methods for CVE-2025-26644

Indicators of Compromise

• Multiple failed biometric authentication attempts followed by successful authentication without password fallback
• Windows Hello authentication events occurring outside normal user patterns or during unusual hours
• Security event logs showing authentication from devices with newly enrolled or modified biometric profiles

Detection Strategies

• Monitor Windows Security Event Logs for Event ID 4624 (successful logon) with Logon Type 7 (Unlock) that may indicate Windows Hello authentication anomalies
• Implement endpoint detection rules to flag unusual patterns in biometric authentication attempts
• Review credential manager and NGC (Next Generation Credential) container access patterns for unauthorized modifications

Monitoring Recommendations

• Enable verbose logging for Windows Hello authentication events in Windows Security logs
• Configure SentinelOne Singularity Platform to monitor for authentication bypass indicators and anomalous logon patterns
• Establish baseline user behavior analytics to detect deviations in biometric authentication patterns

How to Mitigate CVE-2025-26644

Immediate Actions Required

• Apply the latest Windows security updates from Microsoft addressing CVE-2025-26644
• Review Windows Hello enrollment across affected systems and re-enroll biometric credentials where suspicious activity is detected
• Consider implementing multi-factor authentication requiring additional factors beyond Windows Hello biometrics
• Restrict physical access to sensitive workstations and servers running affected Windows versions

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply the patches available through the Microsoft Security Update Guide. The updates improve the detection and handling of adversarial input perturbations in the Windows Hello biometric recognition system.

Priority should be given to patching systems with sensitive data access or elevated privileges, particularly Windows Server 2019 and Windows Server 2025 deployments.

Workarounds

• Disable Windows Hello biometric authentication and require traditional password or PIN-based authentication until patches are applied
• Enable Enhanced Sign-in Security (ESS) which requires hardware with dedicated biometric sensors that support secure communication
• Implement Group Policy to require additional authentication factors for sensitive operations
• Restrict Windows Hello enrollment to managed devices with hardware security features

# PowerShell: Disable Windows Hello for Business via Group Policy
# Run on domain controller or use local Group Policy
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Name "Enabled" -Value 0 -Type DWord

# Require security device for Windows Hello
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Name "RequireSecurityDevice" -Value 1 -Type DWord