N-able has patched a critical vulnerability in its Passportal browser extension that could have allowed any malicious website or embedded iframe to steal long-lived authentication tokens and gain persistent access to a victim’s decrypted password vault.
The flaw, tracked as CVE-2026-15580, affected Passportal extension version 3.49.5 on Google Chrome and Microsoft Edge. N-able released version 3.49.6 within 24 hours of receiving the report, closing an issue rated CVSS v4.0 9.4.
The extension reportedly has more than 73,000 weekly active users. Passportal is a cloud-based password and documentation-management platform built for managed service providers and IT teams.
Critical N-able Passportal Bug
That makes the vulnerability particularly serious: an MSP administrator’s vault can contain privileged credentials, customer infrastructure access, TOTP secrets, and documentation for many downstream organizations.
A compromise would therefore have created a supply-chain-style risk, echoing the potential blast radius associated with attacks against MSP-focused platforms.
The issue was discovered in Passportal’s browser-extension messaging implementation. The extension used window.postMessage to communicate between a web page content script and a Passportal popover iframe.
While this approach is not inherently unsafe, it requires strict validation of message origin, source window, and request context.
In the vulnerable implementation, the content script trusted incoming messages from arbitrary origins and dispatched supported methods based on attacker-controlled message data.
As a result, a malicious site could send a simple request such as window.postMessage({ method: "getPasswords" }, "*") and receive sensitive session data from the extension.
The exposed material reportedly included access and refresh tokens used by the extension to communicate with Passportal’s backend. Unlike a narrow autofill weakness that leaks credentials only for a matching domain, this flaw enabled access to the broader password-management API.
The refresh token was reportedly valid for up to 100 days, allowing persistence well beyond the victim’s initial visit to a malicious webpage. This transformed a browser-based token leak into a long-term vault compromise scenario.
Researchers also identified architectural concerns in the way Passportal handled decryption. Password requests appeared to be processed server-side, with the backend returning decrypted password values and TOTP codes to the extension.
Amibeingpwned stated that the access token reportedly carried sensitive key-related material, including fields described as an organization key and phrase.
JWTs are integrity-protected containers, not confidential storage mechanisms, so placing sensitive cryptographic material inside a token can substantially increase the impact of token theft.
N-able’s patch added controls to ensure that sensitive extension messages are accepted only from the trusted extension origin. The updated handler also verifies the sender frame and a nonce before dispatching requests.
The response timeline was notably fast. Researchers contacted N-able on July 6 after initially identifying suspicious token-request behavior. N-able provided a test account on July 8, received the full report, and deployed the browser-extension update on July 9.
The vendor’s PSIRT team was credited for rapid and cooperative handling of the disclosure. Organizations using Passportal should immediately update all Chrome and Edge installations to version 3.49.6 or later.
They should also review vault and API activity, invalidate active sessions where feasible, and rotate high-value credentials and TOTP secrets if vulnerable versions may have been used.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
