CVE-2026-31278: Suprema BioStar Information Disclosure

CVE-2026-31278 Overview

CVE-2026-31278 is a cleartext credential exposure vulnerability in Suprema BioStar 2 access control software. The flaw resides in the /api/v2/setting/adserversetting endpoint. An authenticated attacker with low privileges can send a crafted GET request and retrieve Active Directory (AD) service account credentials in plaintext. The issue affects Suprema BioStar 2 before version 2.9.12 and BioStar X before 1.0.2. Because AD service accounts frequently hold elevated directory permissions, credential recovery enables lateral movement into the broader enterprise identity plane. The weakness is classified as [CWE-319: Cleartext Transmission of Sensitive Information].

Critical Impact
Exposure of Active Directory service account credentials enables attackers to pivot from a physical access control system into enterprise identity infrastructure.

Affected Products

Suprema BioStar 2 versions before 2.9.12
Suprema BioStar X versions before 1.0.2
Deployments integrating BioStar with Active Directory for authentication

Discovery Timeline

2026-09-14 - CVE-2026-31278 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-31278

Vulnerability Analysis

Suprema BioStar 2 is an access control and workforce management platform used to manage door controllers, biometric readers, and user identity synchronization with enterprise directories. To integrate with Active Directory, administrators configure a service account whose credentials are stored server-side. The /api/v2/setting/adserversetting REST endpoint returns the configuration used for AD synchronization. The endpoint returns the stored service account password in cleartext within the JSON response body. Any authenticated operator session with access to this endpoint can therefore extract domain credentials without needing administrative rights on the underlying host.

Root Cause

The root cause is improper handling of sensitive configuration data at the API boundary. The AD configuration response was not filtered to redact or mask the password field before serialization. Combined with weak authorization checks on the settings endpoint, this design flaw allows a low-privilege session to disclose credentials that should never leave the server in readable form.

Attack Vector

Exploitation requires network reachability to the BioStar web interface and a valid low-privileged session token. The attacker issues an authenticated HTTP GET to the /api/v2/setting/adserversetting path and parses the returned JSON for the AD service account username and password. No user interaction is required. Public proof-of-concept material is referenced on the GitHub CVE-2026-31278 Repository and the GitHub Credential Exposure Repository. Recovered credentials can then be used against LDAP, SMB, or Kerberos services in the target domain.

Detection Methods for CVE-2026-31278

Indicators of Compromise

HTTP GET requests to /api/v2/setting/adserversetting originating from non-administrator user sessions or unusual client IPs.
Successful responses to the AD settings endpoint returning bodies larger than typical baseline sizes, indicating credential retrieval.
Subsequent LDAP or Kerberos authentication attempts from the BioStar server's network segment using the AD service account outside its normal schedule.

Detection Strategies

Enable verbose access logging on the BioStar web server and alert on any read of /api/v2/setting/adserversetting.
Correlate BioStar API access logs with Active Directory authentication events for the configured service account to spot anomalous usage.
Deploy web application firewall rules that flag GET requests to the vulnerable endpoint until patching is confirmed.

Monitoring Recommendations

Monitor domain controllers for logon events (Event ID 4624, 4769) using the BioStar AD service account from unexpected source hosts.
Track outbound LDAP or SMB traffic from the BioStar host to systems it does not normally query.
Alert on password changes or Kerberos ticket requests involving the BioStar service account outside change windows.

How to Mitigate CVE-2026-31278

Immediate Actions Required

Upgrade Suprema BioStar 2 to version 2.9.12 or later, and BioStar X to 1.0.2 or later.
Rotate the Active Directory service account password used by BioStar, assuming it is already compromised.
Restrict network access to the BioStar management interface to trusted administrative subnets.
Review BioStar audit logs for prior GET requests to /api/v2/setting/adserversetting.

Patch Information

Suprema addressed the issue in BioStar 2 2.9.12 and BioStar X 1.0.2. Refer to the Suprema Inc. Official Website for release notes and download links. Apply the patch before rotating credentials so the new password is not re-exposed by an unpatched instance.

Workarounds

Constrain the AD service account to the minimum directory permissions required for BioStar synchronization, following least-privilege principles.
Place the BioStar server behind a reverse proxy that strips or blocks requests to the /api/v2/setting/adserversetting path for non-administrative roles.
Disable Active Directory integration in BioStar until patched if the feature is not operationally required.

bash

# Example reverse proxy rule (nginx) to block the vulnerable endpoint
location = /api/v2/setting/adserversetting {
    return 403;
}