A critical vulnerability in Suprema BioStar 2 and BioStar X allows authenticated attackers to steal cleartext Active Directory service account credentials, posing a significant risk to network authentication integrity.

The flaw exists in the /api/v2/setting/adserversetting endpoint, which fails to protect sensitive information during transmission. An attacker with low-level authenticated access can craft a GET request to extract service account passwords in cleartext.

The exposure of Active Directory service account credentials grants an attacker the ability to impersonate privileged accounts, potentially leading to unauthorized access across the entire domain. With a CVSS score of 7.7, this represents a high-severity risk that could facilitate lateral movement and full compromise of integrated identity services.

Immediate Action: Update Suprema BioStar 2 to version 2.9.12 or later, and BioStar X to version 1.0.2 or later, as these releases contain the necessary security patches.

Proactive Monitoring: Review API access logs for anomalous GET requests directed at the /api/v2/setting/adserversetting endpoint, particularly those originating from unauthorized or non-administrative user accounts.

Compensating Controls: Implement strict network segmentation for the BioStar management console and deploy a Web Application Firewall (WAF) to block unauthorized access to the vulnerable API endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/mda1r/CVE-2026-31278).

Given the potential for complete domain compromise resulting from the theft of Active Directory credentials, this vulnerability should be prioritized for immediate remediation. Organizations using Suprema BioStar 2 or BioStar X must apply the vendor patches without delay and audit their Active Directory service accounts for any signs of unauthorized access or credential misuse.