A high-severity vulnerability discovered in the browser extensions for N-able Passportal could allow malicious websites or embedded iframes to extract an entire organization’s password vault—along with live two-factor authentication tokens.
What was the flaw?
The bug, tracked as CVE-2026-15580 and given a 9.4 score under the CVSS v4.0 rating, affected Passportal extension version 3.49.5. It allowed unsafe communication between the content script and an extension iframe, using window.postMessage with unvalidated origins. That flaw meant any third-party site a logged-in user visited could send a crafted request to the extension and harvest authentication tokens—and from there access vault entries, decrypted passwords, TOTP codes, and long-lived refresh tokens. The refresh tokens could grant ongoing access for up to 100 days. (numbered details drawn from original report) ([cybersecuritynews.com](https://cybersecuritynews.com/n-able-passportal-flaw/))
How widespread & what it impacts
Passportal is a cloud-based privileged access and password management platform designed mainly for managed service providers and IT teams to store credentials and privileged content. Over 73,000 users regularly rely on its Chrome and Edge extensions. The insecure design also included server-side decryption—the passwords are decrypted on N-able’s servers and then sent back to clients—making any token leak more serious. In particular, leaking JSON Web Tokens (JWTs) can expose sensitive session or key material, since JWTs normally ensure integrity, not confidentiality. ([cybersecuritynews.com](https://cybersecuritynews.com/n-able-passportal-flaw/))
The researchers behind the discovery showed how an ordinary website, a malicious ad, or a rogue iframe could pull vault data across an organization, including credentials and 2FA seeds, simply by exploiting this messaging channel. ([cybersecuritynews.com](https://cybersecuritynews.com/n-able-passportal-flaw/))
The fix & mitigation
N-able issued version 3.49.6 of the extension around 24 hours after the issue was disclosed. The patch adds origin validation to the extension’s message handler, checks that messages come from the trusted iframe source, and uses a nonce for sensitive communications to prevent arbitrary sites or frames from sending or receiving messages. ([cybersecuritynews.com](https://cybersecuritynews.com/n-able-passportal-flaw/))
Users are urged to upgrade all Chrome and Edge installations to version 3.49.6 or newer. Admins should audit extension deployment, look for unmanaged browser installations, and rotate high-value credentials and TOTP seeds if exposure is uncertain. ([cybersecuritynews.com](https://cybersecuritynews.com/n-able-passportal-flaw/))
Why this matters & what to do going forward
Even with the patch, concerns remain around the design choice of server-side decryption—many experts say the most critical functions of password managers should operate with end-to-end or client-side encryption. Also, use of global messaging APIs like window.postMessage without strict origin checks remains a common attack vector. ([cybersecuritynews.com](https://cybersecuritynews.com/n-able-passportal-flaw/))
For organizations managing privileged access at scale, this incident underscores the dangers of trust assumptions in browser extensions and cloud-decrypted vaults. As threat actors continue to leverage third-party iframes and malicious sites, enforcing strong message validation and minimizing exposed attack surfaces becomes essential.
