Medium

Vault token disclosure in N-able PassPortal browser extension

IdentifiersCVE-2026-15580CWE-346

CVE-2026-15580 is a critical authentication abuse vulnerability in the N-able PassPortal browser extension for Chrome and Microsoft Edge before version 3.49.6. The flaw is caused by improper origin validation in a window.postMessage-based communication path between the extension’s content script and an embedded extension iframe. The vulnerable message handler accepted messages from arbitrary origins and invoked sensitive functionality without adequately validating the sender, allowing untrusted web pages or embedded iframes presented to a logged-in user to obtain authentication material from the extension. Stolen access and refresh tokens could then be used to interact with PassPortal APIs and retrieve vault contents, including decrypted passwords and time-based one-time password codes. Reported architectural characteristics, including server-side decryption behavior and sensitive key-related material present in JWT access tokens, increased the practical impact of token disclosure.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in compromise of the victim’s PassPortal vault session and persistent unauthorized access to stored secrets. An attacker can steal access and refresh tokens, enumerate vault entries, retrieve decrypted passwords, obtain live TOTP codes, and perform broad vault operations through the application’s APIs. Because refresh tokens reportedly remained valid for up to 100 days, exploitation could provide long-lived access even after the initial browser session ends. In enterprise use, this can expose an organization’s password vault and enable downstream account compromise, privilege escalation, and lateral movement.

Mitigation

If you can’t patch tonight, do this now.

Until all affected systems are upgraded, reduce exposure by limiting use of the vulnerable extension, restricting browsing to trusted sites for users with active PassPortal sessions, and enforcing centralized browser-extension management to identify outdated or unmanaged installations. Organizations should monitor for suspicious vault access and session abuse, and where compromise cannot be excluded, rotate sensitive credentials and re-enroll TOTP secrets. Longer term, safer design patterns include using native browser extension messaging mechanisms instead of broad postMessage channels and adopting stronger client-side end-to-end encryption practices.

Remediation

Patch, then assume compromise.

Upgrade the N-able PassPortal browser extension to version 3.49.6 or later. The vendor patch added origin validation, trusted frame validation, and nonce checks to the extension message-processing logic to prevent arbitrary websites and iframes from invoking sensitive handlers. Ensure Chrome and Edge deployments are updated consistently across managed and unmanaged endpoints. Where exposure is suspected, review affected accounts and consider rotating high-value credentials and TOTP seeds stored in the vault.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

N-AblePassportalapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cyber security newsNews

Aug 21, 2026

Critical N-able Passportal Flaw Lets Malicious Websites Steal Entire Password Vault and 2FA Codes

A critical flaw in N-able Passportal’s Chrome and Microsoft Edge browser extensions caused by improper origin validation in window.postMessage handling, allowing malicious websites or embedded iframes to obtain authentication tokens and access vault contents, including decrypted passwords and TOTP codes.

am i being pwned blogNews

Aug 20, 2026

Solar Winds Part 2 Avoided: N-Able Passportal Vault Leak - Am I Being Pwned?

A critical vulnerability in N-Able PassPortal browser extensions for Chrome and Edge where any website or iframe could abuse insecure window.postMessage handling to obtain access and refresh tokens, enabling full persisted access to the decrypted password vault and TOTP data for up to 100 days.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2