This vulnerability involves missing authentication for a critical function in HYPR Passwordless on Windows, which could lead to interception of credentials. The affected versions are all releases prior to 11.1.1. The CVSS 4.0 vector indicates the attack requires local access with low complexity and privileges, user interaction is required, and the vulnerability impacts confidentiality and security controls. No vendor advisory or patch information is available to confirm remediation status.

An attacker with local access and limited privileges could exploit this vulnerability to intercept credentials due to the lack of authentication on a critical function. This compromises confidentiality and security controls of the affected system. There is no indication of remote exploitation or privilege escalation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local access to trusted users only and monitor for suspicious activity related to credential handling. Avoid user actions that could trigger the vulnerable function if possible.