Reported by 2 outlets
Critical N-able Passportal Bug Lets Malicious Sites Access Password Vaults
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 2.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from gbhackers.com
Critical N-Able PassPortal Extension Flaw Gives Attackers Full Password Vault Access
gbhackers.com · 53d ago · August 21st, 2026
Cybersecurity researchers have revealed a critical vulnerability in N-able’s PassPortal browser extension that could have allowed a malicious website or embedded iframe to obtain authentication materials and take control of a user’s password vault. This vulnerability, tracked as CVE-2026-15580, affects PassPortal version 3.49.5 and has a CVSS v4.0 base score of 9.4. It was patched […] The post Critical N-Able PassPortal Extension Flaw Gives Attackers Full Password Vault Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Critical N-able Passportal Bug Lets Malicious Sites Access Password Vaults
cyberpress.org · 53d ago · August 21st, 2026
N-able has patched a critical vulnerability in its Passportal browser extension that could have allowed any malicious website or embedded iframe to steal long-lived authentication tokens and gain persistent access to a victim’s decrypted password vault. The flaw, tracked as CVE-2026-15580, affected Passportal extension version 3.49.5 on Google Chrome and Microsoft Edge. N-able released version 3.49.6 within 24 hours of receiving the report, closing an issue rated CVSS v4.0 9.4. The extension reportedly has more than 73,000 weekly active users. Passportal is a cloud-based password and documentation-management platform built for managed service providers and IT teams. Critical N-able Passportal Bug That makes the vulnerability particularly serious: an MSP administrator’s vault can contain privileged credentials, customer infrastructure access, TOTP secrets , and documentation for many downstream organizations. A compromise would therefore have created a supply-chain-style risk, echoing the potential blast radius associated with attacks against MSP-focused platforms. Not the best UI we’ve ever seen (Source: amibeingpwned) The issue was discovered in Passportal’s browser-extension messaging implementation. The extension used window.postMessage to communicate between a web page content script and a Passportal popover iframe. While this approach is not inherently unsafe, it requires strict validation of message origin, source window, and request context. In the vulnerable implement