# CVE-2026-31278: Suprema BioStar credential exposure in Active Directory endpoint

Source: https://junglewise.ai/threats/cve-2026-31278-suprema-biostar-credential-exposure-in-active-directory-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-31278 · Severity: high · CVSS 7.7 · Published 2026-09-14

Suprema BioStar 2 and BioStar X are access control and biometric authentication platforms used to manage building and facility security. A vulnerability in the Active Directory configuration API endpoint returns service account passwords in cleartext to authenticated users, despite the UI masking them. An attacker with API access could obtain these credentials and use them to compromise the Active Directory infrastructure, enabling unauthorized access to domain systems and sensitive data.

Technologies: [Suprema BioStar 2](https://junglewise.ai/threats/technologies/biostar-2). Vendors: [Suprema](https://junglewise.ai/threats/vendors/suprema).

## Quick answers

**Is CVE-2026-31278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31278 being exploited in the wild.

**How severe is CVE-2026-31278?** High severity, with a CVSS score of 7.7, published 14 September 2026.

**Which products and versions are affected?** Suprema BioStar 2 before 2.9.12; Suprema BioStar X before 1.0.2.

**Is there a fix for CVE-2026-31278?** A patch was published on 2026-09-14: BioStar 2 v2.9.12 and BioStar X v1.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31278 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-31278?** Check whether you run Suprema BioStar 2 or Suprema BioStar X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /api/v2/setting/adserversetting endpoint in BioStar 2 before 2.9.12 and BioStar X before 1.0.2 improperly discloses Active Directory bind account credentials in plaintext API responses. Although the administrative UI masks the password field, an authenticated GET request to the endpoint returns the full unencrypted password along with LDAP configuration details and SSL settings. An authenticated attacker can retrieve these credentials with a simple GET request, potentially using them to perform LDAP enumeration, lateral movement, and privilege escalation within the Active Directory domain. Patches are available in BioStar 2 v2.9.12 and BioStar X v1.0.2.

## Affected products

- Suprema BioStar 2 before 2.9.12
- Suprema BioStar X before 1.0.2

## Timeline

- 2026-09-14: disclosed: CVE-2026-31278 published
- 2026-09-14: patched: BioStar 2 v2.9.12 and BioStar X v1.0.2 released

## References

- [https://github.com/mda1r/biostar2-ad-credential-exposure](https://github.com/mda1r/biostar2-ad-credential-exposure)
- [https://www.supremainc.com/](https://www.supremainc.com/)

## Related threats

- [Suprema BioStar 2 denial of service via unhandled exception](https://junglewise.ai/threats/cve-2026-9509-suprema-biostar-2-denial-of-service-via-unhandled-exception)
- [Suprema BioStar 2 incorrect permission settings in NGINX webroot](https://junglewise.ai/threats/cve-2026-9508-suprema-biostar-2-incorrect-permission-settings-in-nginx-webroot)