Is the BitLocker Bypass Intentional?

A security expert operating under the alias Chaotic Eclipse (also known as Nightmare-Eclipse) has raised serious questions regarding the security of Windows 11’s BitLocker encryption. After successfully bypassing the system's protections using a simple USB drive, the researcher suggested that the vulnerability might not be a mere oversight.

«Just can't come up with an explanation beside the fact that this was intentional. Also for whatever reason, only Windows 11 (+Server 2022/2025) are affected; Windows 10 is not,» the researcher noted. The vulnerability, dubbed «YellowKey,» allows unauthorized parties to circumvent drive encryption without needing the recovery key.


The Mechanics of the YellowKey Exploit

The process behind the exploit is remarkably straightforward. According to technical details provided by industry analysts, the attack involves the following steps:

  • Acquire a standard USB flash drive.
  • Gain write access to the «System Volume Information» directory.
  • Copy the «FsTx» folder and its contents into that directory.
  • Trigger a restart while holding the Shift key to enter the recovery environment, then hold the Control key during the reboot process.

This sequence allows the machine to bypass standard authentication, granting the user an elevated command line prompt with complete, unrestricted access to the BitLocker-encrypted drive.


Microsoft’s Response and Mitigation Strategies

Chaotic Eclipse chose to release the exploit publicly rather than selling it, citing a personal commitment to security. Microsoft has acknowledged the issue, officially tracking it as CVE-2026-45585. While a comprehensive security patch is being developed, the company has provided temporary mitigation steps for users concerned about the vulnerability:

The tech giant advises users to:

  1. Remove the «autofstx.exe» entry from the Session Manager's BootExecute registry value.
  2. Restore BitLocker trust in the Windows Recovery Environment (WinRE) by following official documentation.
  3. Transition from «TPM-only» mode to «TPM+PIN» mode.

By requiring a pre-boot PIN for decryption, users can effectively neutralize the threat posed by the YellowKey exploit until a permanent fix is issued by the company.