CVE-2026-31278 PUBLISHED

Assigner: mitre
Reserved: 09.03.2026 Published: 14.09.2026 Updated: 14.09.2026

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	supremainc
Product	BioStar 2
Versions	Default: unaffected affected from 0 to 2.9.12 (excl.)

References

https://www.supremainc.com
https://github.com/mda1r/biostar2-ad-credential-exposure

Problem Types

CWE-319 Cleartext Transmission of Sensitive Information CWE