Skip to content
November 14, 2026
  • Bluesky
  • Facebook
  • Linkedin
  • Mastodon
  • RSS
  • Twitter
  • Youtube

Daily CyberSecurity

Zero-hour alerts. Unmatched analysis.

Primary Menu
  • Home
  • ADVISORIES
    • Microsoft
    • Fortinet
    • Ivanti
    • Cisco
    • Linux
    • Citrix
  • CVE Data
    • CVE Watchtower
    • Top Exploited CVEs
    • CVE Stats by Vendor
    • Q3 2026 Report
    • CVE Alerts
    • CVE Alert Settings
    • Pricing
  • Cyber Criminals
  • Data Leak
  • Free Tools
    • CVSS 3.1 Calculator
    • Certificate Viewer
    • DNS Lookup
    • Encoder & Hash Generator
    • IP / Subnet Calculator
    • Whois Lookup
  • Malware
  • Vulnerability News
  • Submit Press Release
Light/Dark Button
  • Home
  • News
  • Windows
  • A Simple New Windows 11 Local Account Bypass Appears
  • Windows

A Simple New Windows 11 Local Account Bypass Appears

Do Son September 14, 2026 2 minutes read
0
Windows 11 Home OOBE local account bypass using the Learn More hyperlink on the sign-in screen

The well-known enthusiast BobPony recently uncovered a new way to circumvent account sign-in on Windows 11 Home. The method proves remarkably simple yet effective. Thereafter, when users installing the system encounter the point in the OOBE interface that forces a Microsoft account login, they can employ this trick to swiftly create a local account.

The Current Flow Demands a Microsoft Account

At present, Windows 11 Home compels users to register and log in with a Microsoft account. The methods once used to skip account sign-in, including OOBE\BYPASSNRO, editing the registry, or invoking start ms-cxh:localonly, have all been progressively removed by Microsoft. Consequently, users can no longer create a local account through the ordinary route.

Attempting to bypass the login with a bogus account such as no@thankyou.com is likewise futile. Naturally, these are all evasion methods that Microsoft has successively deleted across version updates. Therefore, users wishing to bypass account sign-in have found the task relatively troublesome.

The New Bypass Is Exceedingly Simple

On the screen where one enters an account, a lengthy block of Microsoft’s explanatory text sits below, and within it lies a Learn More hyperlink. Users need only click that link, whereupon the details load and the setup then automatically jumps to the create-a-local-account page. BobPony shared the discovery in a post demonstrating the Learn More trick on the Microsoft account sign-in page.

This appears to be some kind of bug. Under normal circumstances, OOBE itself fetches content online, and the Learn More hyperlink ought to display additional information before offering a return button. In reality, however, it leaps directly to the create-a-local-account page, so this is almost certainly an error.

The Bad News for Users

The unfortunate part is that if Microsoft intends to seal off this method, doing so is trivially easy. It need only continue adjusting the OOBE backend server to quickly close the link-redirection error. In that event, users would once again be forced to log in with a Microsoft account, unable to create a local one.

Add Daily CyberSecurity as a preferred source on Google

Related coverage

  • The Windows 11 Civil War: Native Performance Returns While the Microsoft Account Mandate Rages On
  • Microsoft Patches Windows 11 Local Account Bypass Loophole
  • Microsoft Removes Trust in eMudhra Root Certificates
  • Windows 11 KB5132061 Update Fix Resolves Sandbox Error
  • Microsoft Pushes Windows 11 Upgrade Over ESU: Highlighting AI, Security, & Speed Ahead of Win10 EOL
  • Windows 11 Is Finally Getting Automatic Light and Dark Theme Switching
Track all actively exploited CVEs →

Support Our Threat Intelligence

Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee Logo Buy Me a Coffee
Select your plan
Free Pro Team

Hover over a plan to see its benefits.

Get Zero-Hour Vulnerability Alerts

Critical CVEs, CVSS scores, and PoC updates — straight to your inbox every week.

We respect your inbox. Unsubscribe anytime.

SHARE
Share on FacebookShare on XShare on LinkedInShare on TelegramShare on BlueskyShare on Mastodon
Written by
@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.

Tags: BobPony Local Account Microsoft Microsoft Account OOBE Windows 11

Leave a Reply Cancel reply

You must be logged in to post a comment.

🚨 Active Exploits in the Wild

  • CVE-2024-58406CVSS 8.7
    Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request...
    Watchtower Verified📅 Updated: Nov 13, 2026
  • CVE-2026-114713CVSS 8.6
    The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing...
    CISA KEV📅 Added to KEV: Nov 13, 2026
  • CVE-2026-123039CVSS 7.8
    The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating...
    CISA KEV📅 Added to KEV: Nov 13, 2026
  • CVE-2026-20320CVSS 7.5
    A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote...
    CISA KEV📅 Added to KEV: Nov 10, 2026
  • CVE-2026-111793CVSS 4.3
    Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted....
    CISA KEV📅 Added to KEV: Nov 10, 2026
  • CVE-2026-111560CVSS 8.6
    Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda...
    CISA KEV📅 Added to KEV: Nov 10, 2026
  • CVE-2026-116606CVSS 9.3
    An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to...
    CISA KEV📅 Added to KEV: Nov 10, 2026
  • CVE-2026-125350
    Use after free in XML. Reported by anonymous on 2026-11-06. Google is aware that an exploit for CVE-2026-125350...
    CISA KEV📅 Added to KEV: Nov 10, 2026
Powered by CVE Watchtower

Search

CVE ALERTS
📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

Get free CVE alerts Pro from $7/mo

Critical Vulnerabilities

  • CVE-2026-129349CVSS 9.1
    When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that...
    📅 Updated: Nov 14, 2026
  • CVE-2026-55335CVSS 9.8
    In multiple locations, there is a possible use-after-free due to a logic error in the code. This could...
    📅 Updated: Nov 14, 2026
  • CVE-2026-12591CVSS 9.9
    Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration...
    📅 Updated: Nov 14, 2026
  • CVE-2026-12507CVSS 9.1
    Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and...
    📅 Updated: Nov 14, 2026
  • CVE-2026-126229CVSS 9.1
    A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer...
    📅 Updated: Nov 14, 2026
  • CVE-2026-126261CVSS 9.8
    A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0...
    📅 Updated: Nov 14, 2026
  • CVE-2026-126170CVSS 9.8
    A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7,...
    📅 Updated: Nov 14, 2026
  • CVE-2026-126173CVSS 9.8
    The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to,...
    📅 Updated: Nov 14, 2026
Powered by CVE Watchtower

Daily CyberSecurity

  • About Daily CyberSecurity
  • Advertise with us
  • Announcement
  • Contact
  • Contributor Register
  • Login
  • Disclaimer
  • DMCA
  • Privacy Policy

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works

  • CVE Watchtower
  • CVE Statistics by Vendor 2026
  • Q3 2026 Report
  • Top Exploited CVEs
  • Bluesky
  • Facebook
  • Linkedin
  • Mastodon
  • RSS
  • Twitter
  • Youtube
© 2017 - 2026 Daily CyberSecurity. All Rights Reserved.