HYPR Security Advisories

To report a security concern please see HYPR Vulnerability Disclosure

HYPR software routinely undergoes security assessments in order to identify any potential security risks. As a result of these internal and external efforts some vulnerabilities may be identified and proper advisories are sent when remediation is available.

You can find here a list of risks identified in the HYPR components.

CVE ID Risk Affected Version Fix Version Description Component
CVE-2023-1837 High <8.0 8.0

Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs. 

This issue affects HYPR Server before 8.0 with enabled Legacy APIs.

HYPR Server
CVE-2023-1477 High <7.10.2




Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.

HYPR thanks Matthew Rogers for this report.

HYPR Keycloak Authenticator Extension
CVE-2023-0834 High <8.1 8.1

Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.

HYPR thanks Miguel Silva (Blaze Information Security) for this report.

CVE-2022-3258 Low <7.7.1 7.7.1 Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. HYPR Windows WFA
CVE-2022-1984 Medium <7.3 7.3 Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.3 may allow local authenticated attackers to elevate privileges via a malicious serialized payload. HYPR Windows WFA
CVE-2022-2192 High 6.10 to 6.15.1 6.15.2 Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. HYPR Server
CVE-2022-2193 High <6.14.1 6.14.1 Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. HYPR Server