Critical N-able Passportal Flaw Lets Malicious Websites Steal Entire Password Vault and 2FA Codes

A critical vulnerability in N-able Passportal’s Chrome and Microsoft Edge browser extensions could allow a malicious website or embedded iframe to steal an organization’s entire password vault, including live two-factor authentication codes.

Tracked as CVE-2026-15580, the issue received a CVSS v4.0 base score of 9.4 and affected Passportal extension version 3.49.5. N-able released version 3.49.6 to address the flaw within 24 hours of disclosure.

Passportal is N-able’s cloud-based privileged access and password-management platform, primarily used by managed service providers and IT teams to store client credentials and privileged documentation.

More than 73,000 weekly active users reportedly used the platform’s browser extensions. The vulnerability stemmed from unsafe communication between Passportal’s content script and its extension iframe.

The extension used the browser’s window.postMessage mechanism to exchange messages, but its message handler did not validate the sender’s origin.

As a result, any website a logged-in Passportal user visited could send a crafted request and receive usable authentication tokens from the extension.

N-able Passportal Flaw

Those tokens enabled far more than password autofill abuse. An attacker could use them to enumerate vault entries, request decrypted passwords, obtain time-based one-time password codes, and maintain access via refresh tokens for up to 100 days.

A compromised website, malicious advertisement, or injected third-party iframe could therefore expose credentials across an organization’s entire vault.

AmIBeingPwned research found that Passportal decrypts passwords on its servers and sends the decrypted credentials back to clients, increasing the security risk.

Sensitive key-related material was also reportedly present in JWT access tokens. Because JSON Web Tokens provide integrity protection rather than confidentiality by default, leaking them can expose highly sensitive session and cryptographic data.

N-able’s patch added origin validation to the extensions message-processing logic. The updated handler verifies that messages originate from the extension itself, checks the trusted iframe source, and validates a nonce before processing sensitive requests.

This prevents arbitrary websites and iframes from accessing the extension’s internal messaging channel. N-able deployed the fix the day after receiving the detailed report.

Organizations using N-able Passportal should immediately verify that all Chrome and Edge deployments run version 3.49.6 or later.

Administrators should also review extension-management policies, identify unmanaged browser installations, and consider rotating high-value credentials and TOTP seeds where exposure cannot be ruled out.

While the token-leakage flaw has been fixed, the reported server-side decryption design remains a security concern because a password manager’s most sensitive functions depend on cloud-side processing.

Researchers recommended moving toward a client-side, end-to-end encryption model and using native browser extension messaging APIs instead of the widely exposed window postMessage channels.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC