Browser Extension Bug Exposed Enterprise Password Management Systems to Account Takeover Risk
A critical security flaw in N-able’s PassPortal browser extension could have allowed attackers to access protected password vault data by abusing unsafe communication between the extension and web pages.
Tracked as CVE-2026-15580, the vulnerability received a CVSS v4.0 score of 9.4 and affected PassPortal extension version 3.49.5. N-able addressed the issue in version 3.49.6 after researchers reported the problem.
The flaw exposed authentication tokens that could potentially provide long-term access to user vaults, putting thousands of active users at risk.
Vulnerability Allowed Malicious Websites to Access Vault Sessions
The security issue originated from improper validation of communication between PassPortal’s content script and an iframe used by the extension to display password suggestions.
The extension relied on the browser’swindow.postMessagemechanism but failed to properly verify the origin of incoming requests. This allowed untrusted websites or embedded frames to send commands to the extension and request sensitive information.
Researchers found that an attacker could exploit the flaw by convincing a logged-in PassPortal user to visit a specially crafted website.
No compromise of N-able’s infrastructure was required. The attack depended only on abusing the extension’s privileged browser functionality.
Exposed Tokens Could Provide Full Vault Access
The vulnerability could expose both access and refresh tokens.
While access tokens are typically short-lived, the refresh token could allow attackers to maintain access for an extended period, potentially up to 100 days.
With stolen authentication materials, attackers could potentially:
- Browse stored vault entries
- Retrieve passwords
- Access time-based one-time password (TOTP) codes
- Maintain active sessions
- Modify or delete vault information
This effectively provided full management capabilities over affected password vaults.
Server-Side Decryption Increased Impact
Researchers noted that PassPortal’s architecture contributed to the severity of the issue.
Password and TOTP decryption processes were handled through server-side mechanisms rather than being performed exclusively on the customer’s device.
As part of this process, the extension exchanged key-related information when requesting credentials. Researchers discovered organization-related key data and sensitive information contained within JWT access tokens.
Although JWTs protect data integrity, they do not automatically encrypt their contents. Any exposed sensitive information inside these tokens could therefore create additional security risks.
N-able Released a Rapid Fix
The vulnerability was discovered by researchers from Am I Being Pwned through automated security testing.
The researchers reported the issue to N-able on July 6, 2026. After validation, the company released updated browser extensions for Chrome and Microsoft Edge on July 9.
The security update introduced several protections, including:
- Strict origin verification
- Trusted frame validation
- Nonce checks for message requests
- Blocking unauthorized access to privileged extension functions
These changes prevent malicious websites from interacting with internal extension components.