Critical N-able Passportal Flaw Exposes Password Vaults, 2FA Codes

Key Takeaways

• A critical vulnerability (CVE-2026-15580) in N-able Passportal browser extensions allowed full password vault and 2FA code theft.
• The flaw affected Passportal extension version 3.49.5 for Chrome and Microsoft Edge.
• N-able rapidly released a patch, version 3.49.6, within 24 hours of disclosure.
• Organizations must update extensions immediately and consider rotating high-value credentials.

Critical N-able Passportal Flaw Exposes Password Vaults, 2FA Codes

A severe security vulnerability discovered in the N-able Passportal browser extensions for Chrome and Microsoft Edge could have allowed malicious websites or embedded iframes to exfiltrate an organization’s entire password vault, including live two-factor authentication (2FA) codes. This critical flaw highlights the inherent risks in browser-based password management solutions.

Designated as CVE-2026-15580, the issue was assigned a CVSS v4.0 base score of 9.4, indicating its high severity. The vulnerability specifically impacted Passportal extension version 3.49.5. N-able responded swiftly, releasing version 3.49.6 to remediate the defect within 24 hours of its reporting.

Understanding the Vulnerability

N-able Passportal serves as a cloud-based privileged access and password management platform, widely adopted by managed service providers (MSPs) and internal IT departments to securely store client credentials and sensitive documentation. The platform’s browser extensions are extensively used, reportedly by over 73,000 active users weekly.

The core of the vulnerability stemmed from insecure communication practices between Passportal’s content script and its extension iframe. The extension utilized the browser’s window.postMessage mechanism for inter-process communication. However, its message handler failed to adequately validate the origin of incoming messages. This critical oversight meant that any website visited by a logged-in Passportal user could craft and send a malicious request, subsequently receiving usable authentication tokens directly from the extension.

These compromised tokens provided attackers with extensive capabilities beyond simple password autofill abuse. An adversary could leverage them to enumerate vault entries, request decrypted passwords, obtain time-based one-time password (TOTP) codes, and even maintain persistent access via refresh tokens for up to 100 days. Consequently, a compromised website, a malicious advertisement, or an injected third-party iframe could have led to the complete exposure of credentials across an organization’s entire vault.

AmIBeingPwned research found that Passportal’s architecture involves decrypting passwords on its servers before sending the decrypted credentials back to client-side extensions. This design choice, where sensitive decryption occurs server-side, inherently escalates the security risk, as it centralizes a critical point of failure.

Further analysis revealed that sensitive key-related material was present within JSON Web Tokens (JWT) access tokens. Given that JWTs primarily offer integrity protection rather than confidentiality by default, their leakage can inadvertently expose highly sensitive session and cryptographic data, compounding the potential impact of the vulnerability.

The Remediation and Recommendations

N-able’s patch, implemented in version 3.49.6, introduced robust origin validation into the extension’s message-processing logic. The updated handler now rigorously verifies that messages originate from the extension itself, confirms the trusted iframe source, and validates a nonce before processing any sensitive requests. This crucial enhancement effectively prevents arbitrary websites and iframes from illicitly accessing the extension’s internal messaging channel. N-able deployed this fix promptly, the day after receiving the comprehensive vulnerability report.

What You Should Do

• Immediate Update: All organizations utilizing N-able Passportal must immediately confirm that all Chrome and Microsoft Edge browser deployments are running extension version 3.49.6 or later.
• Review Extension Policies: Administrators should review their browser extension management policies to identify and update any unmanaged browser installations.
• Credential Rotation: Consider rotating high-value credentials and TOTP seeds, especially for accounts where potential exposure cannot be definitively ruled out.
• Architectural Review: While the token-leakage flaw has been addressed, the reported server-side decryption design remains a significant security concern. Researchers recommend a strategic shift towards a client-side, end-to-end encryption model for password managers.
• API Usage: It is also advised to leverage native browser extension messaging APIs instead of the more broadly exposed window.postMessage channels for sensitive communications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.