Security researchers at ERNW have revealed a high-impact vulnerability in Windows Hello for Business that enables attackers to bypass facial recognition protections by substituting their own biometric data for that of authorized users. The flaw exposes weaknesses in how facial templates are handled and stored on Windows devices, despite recent improvements aimed at bolstering biometric authentication.
Attack Requires Admin Access, Exploits Local Template Storage
The vulnerability, detailed in a July 2025 report by Tillmann Oßwald of ERNW, allows attackers with local administrative access on a domain-joined Windows device to tamper with stored biometric templates. Once in control, an attacker can swap out a legitimate user’s facial data with their own, granting them the ability to log in as that user—including accounts with elevated privileges such as IT staff or domain administrators.
To exploit the flaw, an attacker must first compromise a Windows device connected to an organization’s domain and gain local administrator rights. With these privileges, they can access and manipulate the encrypted facial recognition data stored locally on the machine. This is possible because the biometric service in Windows Hello runs under the NT AUTHORITY\SYSTEM account, giving local administrators the ability to decrypt and alter the templates.
System Design Undermines Enhanced Biometric Security
The discovery is notable in light of recent security enhancements to Windows Hello, introduced in April 2025. These updates require that both the RGB and infrared (IR) sensors detect a live face before authentication can proceed, effectively preventing facial recognition from working in total darkness. However, the newly disclosed vulnerability bypasses these requirements by tampering directly with stored biometric data.
Some security experts have suggested storing templates within a Trusted Platform Module (TPM) as a safeguard. However, ERNW’s researchers argue this would not prevent an attacker with administrative privileges from accessing the same data. “The only solution would be to use the user’s biometrics as entropy,” they explained. “Microsoft uses this approach if a PIN is used to authenticate with WHfB. However, this would result in a massive overhaul of the system’s architecture.”
Concerns are heightened by the increasing enterprise adoption of Windows Hello as a passwordless login system for cloud services, VPNs, and corporate networks. Although Microsoft offers Enhanced Sign-in Security (ESiS) to mitigate risks, ERNW says these protections do not address the core architectural issues. The researchers report that Microsoft has been notified, but similar flaws have gone unresolved in the past.
Sources: Cybernews, Insinuator.net
–
by Ali Nassar-Smith
