Search
Find merged stories by title or summary.
Critical N-able Passportal Flaw Lets Malicious Websites Steal Entire Password Vault and 2FA Codes
A critical vulnerability in N-able Passportal’s Chrome and Microsoft Edge browser extensions could allow a malicious website or embedded iframe to steal an organization’s entire password vault, including live two-factor authentication codes . Tracked as CVE-2026-15580, the issue received a CVSS v4. 0 base score of 9. 4 and affected Passportal extension version 3. 49. 5. N-able released version 3. 49. 6 to address the flaw within 24 hours of disclosure. Passportal is N-able’s cloud-based privileged access and password-management platform, primarily used by managed service providers and IT teams to store client credentials and privileged documentation. More than 73,000 weekly active users reportedly used the platform’s browser extensions. The vulnerability stemmed from unsafe communication between Passportal’s content script and its extension iframe.
Critical N-able Passportal Bug Lets Malicious Sites Access Password Vaults
N-able has patched a critical vulnerability in its Passportal browser extension that could have allowed any malicious website or embedded iframe to steal long-lived authentication tokens and gain persistent access to a victim’s decrypted password vault. The flaw, tracked as CVE-2026-15580, affected Passportal extension version 3. 49. 5 on Google Chrome and Microsoft Edge. N-able released version 3. 49. 6 within 24 hours of receiving the report, closing an issue rated CVSS v4. 0 9. 4. The extension reportedly has more than 73,000 weekly active users. Passportal is a cloud-based password and documentation-management platform built for managed service providers and IT teams.
You've reached the end of current stories for this search.