CVE-2026-31278 Details

A vulnerability in Suprema BioStar 2 versions prior to 2.9.12 and BioStar X versions prior to 1.0.2 allows authenticated attackers to retrieve Active Directory service account passwords in plaintext. This issue arises in the API endpoint '/api/v2/setting/adserversetting', where credentials are improperly exposed despite being masked in the administrative interface. The vulnerability could be exploited by sending a crafted GET request to the endpoint, thereby disclosing sensitive information that could be used for unauthorized access or actions within the Active Directory environment.

Users are advised to update to Suprema BioStar 2 version 2.9.12 or BioStar X version 1.0.2. Additionally, all Active Directory service account passwords should be rotated, API access should be restricted to trusted network segments, and LDAPS (SSL) should be enabled for Active Directory communications.