A significant security flaw in the N-able Passportal extensions for Chrome and Microsoft Edge has been identified, potentially enabling malicious websites to access an organization’s entire password vault and active two-factor authentication codes.
Details of the Vulnerability
The flaw, identified as CVE-2026-15580, received a critical CVSS v4.0 base score of 9.4. It affected version 3.49.5 of the Passportal extension. N-able addressed this issue by releasing version 3.49.6 within 24 hours of being informed of the vulnerability.
Passportal serves as a cloud-based platform for password and privileged access management, primarily utilized by managed service providers and IT teams for storing client credentials and sensitive documentation. The vulnerability was rooted in unsafe interactions between the content script and the extension’s iframe.
Mechanisms of Exploitation
The browser extension employed the window.postMessage mechanism for message exchanges but failed to validate the sender’s origin. Consequently, any website visited by a logged-in Passportal user could issue a request to access authentication tokens from the extension.
These tokens could be exploited beyond just filling in passwords automatically. Attackers could list vault entries, request decrypted passwords, acquire time-based one-time password codes, and maintain access using refresh tokens for up to 100 days. Such a breach could occur through compromised websites, malicious ads, or injected iframes.
N-able’s Response and Recommendations
N-able has implemented a patch that enhances the message-processing logic of the extensions by verifying that messages originate from the extension itself and validating trusted iframe sources, thus preventing unauthorized access to the extension’s messaging channel.
Organizations using N-able Passportal should ensure their browser extensions are updated to version 3.49.6 or later. Administrators are advised to review extension management policies, identify unmanaged browser installations, and consider resetting high-value credentials where potential exposure cannot be excluded.
Despite the fix for the token-leakage flaw, concerns about server-side decryption remain, as it involves cloud-side processing of sensitive functions of the password manager. Experts recommend transitioning to a client-side, end-to-end encryption model and using native browser extension messaging APIs instead of the exposed window.postMessage channels.
Organizations are encouraged to enhance their cybersecurity protocols promptly to prevent data breaches and ensure the integrity of their password management systems.
