CVE-2026-61928 exposes sensitive Windows Hello authentication data stored in cleartext rather than protected by DPAPI, with a CVSS of 5.5 that reflects an 'authorized attacker' qualifier. The real issue is not that a developer made a poor storage choice, but that Windows Hello's design treats user-context processes as trustworthy — a security boundary that evaporates under any realistic post-authentication attack.
The 'authorized attacker' qualifier is the most dangerous assumption in this CVE. Any malware achieving user-level code execution inherits Windows Hello's trust model, which means the threat model protects against a different class of adversary than the one that actually arrives. This isn't a gap in the threat model — it's the threat model working exactly as designed, against a narrower threat actor than reality presents.
When Microsoft's own platform provides DPAPI and Credential Manager yet developers route around them to use cleartext file storage, this points to a deeper failure: the platform vendor's convenience authentication layer (Windows Hello) was not designed to couple with companion secure storage APIs. This is a cross-platform pattern — Apple, Android, and Microsoft have all shipped biometric auth layers that outpace secure storage guidance — but Microsoft's institutional memory has repeatedly failed to correct it. The CVE history shows the same 'authorized attacker' threat model under-scoping recurring across credential-related vulnerabilities without fundamental architectural correction.
For defenders: treat this as a HIGH-severity architectural issue despite the CVSS. Audit any Windows Hello implementations for cleartext storage of biometric enrollment data, authentication tokens, or related sensitive state. Assume any user-context compromise (malware, browser exploit, drive-by download) gives attackers access to whatever Windows Hello considered 'protected.' The patch addresses the cleartext storage, but the threat model failure compounds across every audit and penetration test that takes Microsoft's severity rating at face value. Prioritize architectural review over patch deployment.