Loading story…
A critical flaw in N-able Passportal’s Chrome and Microsoft Edge extensions allowed a malicious website or embedded iframe to steal access and refresh tokens and fully compromise a user’s password vault. The bug, tracked as CVE-2026-15580 with a CVSS v4.0 score of 9.4, stemmed from improper origin validation in window.postMessage handling, causing the extension to trust messages from arbitrary sites. Researchers said an attacker could use the stolen tokens to enumerate stored credentials, retrieve live TOTP codes, and maintain access for as long as 100 days through refresh tokens.
N-able said the issue affected extension version 3.49.5 and released 3.49.6 within 24 hours, adding origin checks, trusted iframe validation, and nonce validation. Researchers warned that the impact was amplified by Passportal’s broader design, including server-side decryption rather than end-to-end encryption and reports that sensitive key-related material was present in JWT access tokens. The exposure is especially significant for MSPs and downstream customers that rely on Passportal in managed service and supply-chain environments, and defenders were urged to verify updates and consider rotating high-value credentials and TOTP seeds where compromise is possible.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
James Arnott of Bay Area Labs discovered a vulnerability in N-able Passportal's browser extension that allowed arbitrary websites to obtain authentication tokens because the extension did not validate message origins. The issue affected Passportal extension version 3.49.5 and enabled theft of vault contents and TOTP codes.
The Passportal browser extension vulnerability was tracked as CVE-2026-15580 and given a CVSS v4.0 base score of 9.4. Reporting on the flaw also highlighted residual architectural risk from Passportal's server-side decryption design.
N-able deployed a fix the day after receiving the confirmed findings, releasing Passportal browser extension version 3.49.6 within 24 hours. The patch added origin validation and related checks to prevent arbitrary websites or iframes from abusing the extension's messaging channel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cert.dk
Open sourcecybersecuritynews.com
Open sourcedarkreading.com
Open sourceamibeingpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-18397**, a drive-by remote code execution vulnerability in SConnect, a browser extension and native host reportedly used by more than one million users for hardware-token authentication and digital signing. The flaw, reported with a **CVSS score of 9.4**, was demonstrated against version 2.16.0.0 and allowed any visited website or embedded iframe to silently download and execute an unsigned DLL. An uninitialized-memory flaw in SConnect’s custom RSA-2048 verifier, combined with heap spraying, bypassed website authorization and add-on signature checks. SConnect supports sensitive workflows involving SWIFT, 3SKey, electronic IDs, and other signing tokens. Thales received the report on June 29, 2026, subsequently released updates through Apple and Chrome distribution channels, and removed the Edge extension in September. Researchers could not confirm whether existing Edge installations were automatically removed. Organizations should inventory SConnect deployments, verify that both browser extensions and native hosts are updated, and explicitly check for remaining Edge installations, prioritizing financial authentication and signing workstations. The disclosure did not establish the full deployment footprint, demonstrate unauthorized interactions with connected security tokens, or report exploitation in the wild.
Oct 3, 2026
A critical vulnerability in Fortinet's FortiPAM Chrome extension, tracked as **CVE-2026-84388** and rated **CVSS 9.1**, allowed a malicious website to register itself as a trusted FortiPAM server and invoke the privileged-access extension without valid JWT authentication. FortiPAM is a privileged-access-management component reported to have more than one million users. An attacker could provide a malicious privileged-session configuration that changed the browser proxy, opened an attacker-selected tab, automatically approved the extension's consent prompt, and streamed recordings of that tab to an attacker-controlled server. The flaw enabled low-effort phishing and exposure of sensitive content, including API keys, viewed in the opened tab; it was reported July 17 and fixed August 1, with no known in-the-wild exploitation reported.
Sep 9, 2026
n8n disclosed **CVE-2026-59208**, an improper authentication flaw in the Enterprise **token exchange** feature that can let a user with a valid JWT from one trusted external issuer be logged into another user’s local account. The bug stems from n8n matching identities only on the JWT `sub` claim while ignoring the `iss` claim, creating a cross-issuer collision risk when multiple trusted issuers are configured and subject values overlap. Successful exploitation could give an attacker the victim’s n8n permissions, including access to workflows, stored credentials, and connected business systems. The issue affects Enterprise deployments using token exchange with at least two trusted external issuers configured, including versions earlier than **2.27.4** on the 2.27 branch and **2.28.0** on the 2.28 branch. n8n fixed the flaw in **2.27.4** and **2.28.1** on June 24, and public reporting said there was no confirmed active exploitation or public proof-of-concept as of July 16. Organizations are advised to upgrade immediately, review trusted issuer settings, validate issuer-to-user binding after patching, and, if patching is delayed, reduce configurations to a single issuer or disable token exchange temporarily.
Jul 17, 2026