YellowKey Bitlocker Bypass Vulnerability
Summary
YellowKey is a proof-of-concept exploit that bypasses BitLocker encryption on Windows 11 by leveraging a vulnerability in the Windows Recovery Environment, allowing unrestricted access to protected volumes.
View Cached Full Text
Cached at: 05/13/26, 02:16 PM
Nightmare-Eclipse/YellowKey
Source: https://github.com/Nightmare-Eclipse/YellowKey
YellowKey
YellowKey Bitlocker Bypass Vulnerability
Been a while since I saw a bitlocker bypass around, my turn.
This is one of the most insane discoveries I ever found, almost feels like backdoor but what do you know, maybe I’m just insane.
How to reproduce :
- Copy the FsTx folder to “YourUSBStick:\System Volume Information\FsTx” as is and make sure to use a filesystem that’s compatible with Windows (NTFS is preferable but I think FAT32/exFAT should work as well). Funny thing is, the vulnerability is extremely convenient, you don’t even need to plug an external storage device, you can just pull out the disk, copy the files in the EFI partition, put it back and it will still work. That’s how bad it is.
- Plug the USB stick in your target windows computer with bitlocker protection turned on.
- Reboot to Windows Recovery Environment Agent (you can do that by holding SHIFT and clicking on the restart button using your mouse)
- Once you click on the restart button, lift your finger off the SHIFT key and hold CRTL and do NOT lift your finger off it.
- If you did everything properly, a shell will spawn with unrestricted access to the bitlocker protected volume.
Now why would I say this is a backdoor ? The component that is responsible for this bug is not present anywhere (even in the internet) except inside WinRE image and what makes it raise suspicions is the fact that the exact same component is also present with the exact same name in a normal windows installation but without the functionalities that trigger the bitlocker bypass issue. Why ? I just can’t come up with an explanation beside the fact that this was intentional. Also for whatever reason, only windows 11 (+Server 2022/2025) are affect, windows 10 is not.
A huge thanks to MORSE, MSTIC and Microsoft GHOST for making this public disclosure possible ;)
Similar Articles
Microsoft BitLocker – YellowKey zero-day exploit
A security researcher released a zero-day exploit called YellowKey that bypasses Microsoft BitLocker encryption on Windows 11 and Windows Server 2022/2025, allowing full access to locked drives using a USB stick; the exploit appears to operate as a backdoor, with files disappearing after use.
Mystery Microsoft bug leaker keeps the zero-days coming
An anonymous researcher released two Microsoft zero-day exploits, YellowKey (BitLocker bypass) and GreenPlasma (privilege escalation), after Patch Tuesday, posing serious security risks for organizations.
Security researcher says Microsoft built a Bitlocker backdoor, releases exploit
A security researcher claims Microsoft built a backdoor into BitLocker and releases an exploit, raising concerns about encryption integrity.
@vintcessun: After BitLocker encryption, conventional wisdom says no password equals useless. But the GreatXML vulnerability makes us rethink: as long as the target's Windows Defender has performed an offline scan, the entire hard drive becomes defenseless. The key is the angle of approach—not brute force, but inserting an unattend.xml through WinRE to trigger an automated deployment process, opening a shell directly in the recovery environment.
A vulnerability named GreatXML has been discovered that exploits the state after Windows Defender offline scans. By injecting an unattend.xml via WinRE, it bypasses BitLocker encryption and gains access to the hard drive.
Unlocking Encrypted ZFS Volumes with a Passkey
The article introduces Revaulter v2, a tool that enables unlocking encrypted ZFS volumes at boot using passkeys (WebAuthn), allowing remote approval via a mobile web interface without storing keys in plaintext.