CVE-2020-11005
Internal NCryptDecrypt method could be used externally from WindowsHello library.
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again. This has been patched in version 1.0.4.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.1 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.
Weakness
Affected products
- affected < 1.0.4
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- NuGetHaemmerElectronics.SeppPenner.WindowsHelloGHSA-wvpv-ffcv-r6cw (opens in a new tab)
References (2)
- https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6cw (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/SeppPenner/WindowsHello/issues/3 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-wvpv-ffcv-r6cw (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-11005)Record last updated .