CVE-2026-15580 in PassPortal Extension
Summary
by MITRE • 08/21/2026
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.
This issue affects the PassPortal browser extension: before 3.49.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The identified vulnerability represents a critical security flaw within the N-able PassPortal browser extension, specifically affecting versions prior to 3.49.6. This weakness stems from an improper validation of messages received via the window.postMessage API, which is commonly used for communication between different browsing contexts such as web pages and extensions or iframes. In this specific instance, the application fails to adequately verify the origin of incoming postMessage events before processing them. This lack of strict origin checking allows any malicious webpage loaded in a user's browser to inject arbitrary messages into the extension's message queue. Because the extension trusts these unvalidated inputs, it proceeds to execute actions based on data that has not been authenticated or authorized by the legitimate application logic.
The primary technical consequence of this flaw is the unauthorized disclosure of sensitive vault tokens. These tokens serve as credentials for authenticating with various password management services and are essential for maintaining secure access to stored secrets. By exploiting the unvalidated postMessage channel, an attacker can trick the extension into revealing these high-value authentication artifacts. This effectively bypasses the intended security boundaries established by the browser's same-origin policy, allowing cross-site scripting-like attacks where a malicious site can extract sensitive data from the privileged context of the browser extension. The vulnerability is classified under CWE-918, which addresses Server-Side Request Forgery (SSRF) flaws related to web message handling, although in this client-side context it aligns more closely with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function within the extension's API surface.
From an operational perspective, the impact of this vulnerability is severe due to its potential for authentication abuse. Once an attacker obtains a valid vault token through this mechanism, they can impersonate the legitimate user across all services protected by that specific password manager integration. This leads directly to account takeover scenarios where sensitive corporate or personal data becomes accessible to unauthorized parties. The attack vector requires social engineering elements such as convincing a victim to visit a malicious website while having the PassPortal extension active and authenticated. However, given the prevalence of drive-by downloads and compromised advertising networks, this risk is significant in real-world environments. This behavior maps directly to MITRE ATT&CK technique T1503.002, which covers Accessible Credential Store via browser extensions, highlighting how attackers leverage trusted software components to harvest credentials without needing direct network intrusion or malware installation on the host system.
To mitigate this risk, organizations and individual users must prioritize immediate patching of the N-able PassPortal extension to version 3.49.6 or later where these validation checks have been implemented. Security teams should enforce strict content security policies that restrict postMessage origins to only known and trusted domains if such configuration is possible within the browser environment. Additionally, monitoring for unusual authentication patterns from new devices or locations can help detect potential exploitation attempts in real time. It is also advisable to review extension permissions and disable any unused features of password managers to reduce the attack surface. Regular audits of third-party software installed in browsers are essential to maintain a robust security posture against client-side vulnerabilities that bypass traditional network defenses.