The vulnerability of the biometric authentication function in Windows Hello on Windows operating systems allows attackers to enhance their privileges.

🗓️ 16 Jan 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The Windows Hello biometric authentication vulnerability allows privilege escalation due to access control weaknesses.

Reporter	Title	Published	Views	Family All 29
ATTACKERKB	CVE-2026-20804	13 Jan 202617:56	–	attackerkb
Circl	CVE-2026-20804	13 Jan 202618:01	–	circl
CNNVD	Microsoft Windows Hello 安全漏洞	13 Jan 202600:00	–	cnnvd
CVE	CVE-2026-20804	13 Jan 202617:56	–	cve
Cvelist	CVE-2026-20804 Windows Hello Tampering Vulnerability	13 Jan 202617:56	–	cvelist
EUVD	EUVD-2026-2197	13 Jan 202617:56	–	euvd
Japan Vulnerability Notes	Security information for Hitachi Disk Array Systems	20 Feb 202609:35	–	jvn
Microsoft KB	January 13, 2026—KB5073379 (OS Build 26100.32230)	13 Jan 202616:00	–	mskb
Microsoft KB	January 13, 2026—KB5073450 (OS Build 25398.2092)	13 Jan 202616:00	–	mskb
Microsoft KB	January 13, 2026—KB5073455 (OS Build 22631.6491)	13 Jan 202616:00	–	mskb

Vulners

Node

microsoft windows_server_2025Range<10.0.26100.32230

OR

microsoft windows_11_24h2Range<10.0.26100.7623

OR

microsoft windows_server_2022,_23h2_edition_(server_core_installation)Range<10.0.25398.2092

OR

microsoft windows_11_23h2Range<10.0.22631.6491

OR

microsoft windows_11_25h2Range<10.0.26200.7623

OR

microsoft windows_server_2025_(server_core_installation)Range<10.0.26100.32230

OR

microsoft windows_10_22h2Range<10.0.19045.6809

OR

microsoft windows_10_21h2Range<10.0.19044.6809

OR

microsoft windows_server_2022_(server_core_installation)Range<10.0.20348.4648

OR

microsoft windows_server_2022Range<10.0.20348.4648

OR

microsoft windows_server_2019_(server_core_installation)Range<10.0.17763.8276

OR

microsoft windows_server_2019Range<10.0.17763.8276

OR

microsoft windows_10_1809Range<10.0.17763.8276

OR

microsoft windows_server_2016_(server_core_installation)Range<10.0.14393.8783

OR

microsoft windows_server_2016Range<10.0.14393.8783

OR

microsoft windows_10_1607Range<10.0.14393.8783

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20804
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2026011422
dbugs	www.dbugs.ptsecurity.com/vulnerability/PT-2026-2657
web	www.web.nvd.nist.gov/view/vuln/detail

16 Jan 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.6

CVSS 37.7

EPSS0.00498

Windows Hello flaw Biometric authentication Access control weakness Privilege escalation