CVE-2026-2414 is a critical authorization bypass through a user-controlled key (CVSS 9.8) in HYPR Server, the passwordless authentication product. It affects versions from 9.5.2 before 10.7.2 and allows privilege escalation. Upgrade to 10.7.2 or later and check the HYPR security advisories page.
What's affected
HYPR Server from 9.5.2 up to but not including 10.7.2, per the record. The fixed release is 10.7.2. The record points to the HYPR security advisories page. The text I could read on that page did not include details of this CVE, so check it for the vendor wording and any extra steps.
How to check if you're exposed
Check the HYPR Server version in your admin console or deployment records. If it falls in the range above, you are in scope. Then review who can reach the server's APIs and whether it is exposed to the internet, since the vector in the record is network reachable and needs no login.
What to do now
- Upgrade HYPR Server to 10.7.2 or later, following HYPR's upgrade guidance.
- Read the HYPR security advisories page for this CVE and follow any steps it adds.
- Review administrator and privileged accounts for unexpected changes, and check audit logs for role or permission changes you did not make.
- Restrict network access to administrative interfaces where you can.
Why it matters
The weakness is CWE-639, authorization bypass through a user-controlled key. In general this class means the server uses an identifier supplied by the client to find a resource or a role, without checking that the caller may use it. This is often called an insecure direct object reference.
An identity product is a high value target because it decides who gets access to everything else. The record gives few details, and I will not guess at the mechanism. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-03-25. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Is this a flaw in the passkeys themselves?
The record does not say that. It describes an authorization bypass in HYPR Server that allows privilege escalation.
Sources
Last reviewed: 19 October 2026.
