Click Studios Passwordstate hard-coded credentials
Priority LOW 27CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.
Why it matters now
EPSS 0.01309 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Click Studios | Passwordstate | all versions | — | No fix listed | CNA |
| Click Studios | Passwordstate Browser Extension Chrome | all versions | — | No fix listed | CNA |
- Passwordstate VendorClick Studios Affected all versions Fixed in — No fix listed CNA
- Passwordstate Browser Extension Chrome VendorClick Studios Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:clickstudios:passwordstate:*:*:*:*:*:*:*:* | before 9.5 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9500:*:*:*:-:*:* | 9.5 build_9500 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9512:*:*:*:-:*:* | 9.5 build_9512 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9519:*:*:*:-:*:* | 9.5 build_9519 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9531:*:*:*:-:*:* | 9.5 build_9531 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9533:*:*:*:-:*:* | 9.5 build_9533 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9535:*:*:*:-:*:* | 9.5 build_9535 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5:build_9583:*:*:*:-:*:* | 9.5 build_9583 | Vulnerable | Click Studios |
| cpe:2.3:a:clickstudios:passwordstate:9.5.8.4:*:*:*:*:chrome:*:* | 9.5.8.4 | Vulnerable | Click Studios |
- cpe:2.3:a:clickstudios:passwordstate:*:*:*:*:*:*:*:* Versions before 9.5 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9500:*:*:*:-:*:* Versions 9.5 build_9500 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9512:*:*:*:-:*:* Versions 9.5 build_9512 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9519:*:*:*:-:*:* Versions 9.5 build_9519 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9531:*:*:*:-:*:* Versions 9.5 build_9531 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9533:*:*:*:-:*:* Versions 9.5 build_9533 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9535:*:*:*:-:*:* Versions 9.5 build_9535 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5:build_9583:*:*:*:-:*:* Versions 9.5 build_9583 Vulnerable ·Click Studios
- cpe:2.3:a:clickstudios:passwordstate:9.5.8.4:*:*:*:*:chrome:*:* Versions 9.5.8.4 Vulnerable ·Click Studios
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4611
- 2026-10-03 Alias added: GHSA-gc6m-vvjp-f3xm
References
More Click Studios Passwordstate vulnerabilities
- TI-2022-03552 Click Studios Passwordstate API authentication bypass by assumed-immutable data CVSS 3.1HIGH 7.5
- TI-2022-04216 Click Studios Passwordstate Browser Extension Provisioning improper authorization CVSS 3.1MEDIUM 6.5
- TI-2022-04215 Click Studios Passwordstate insufficiently protected credentials CVSS 3.1MEDIUM 6.5
- TI-2022-03553 Click Studios Passwordstate API authorization CVSS 3.1MEDIUM 6.5
- TI-2022-04213 Click Studios Passwordstate risky encryption CVSS 3.1MEDIUM 5.5
- TI-2022-03554 Click Studios Passwordstate URL Field cross site scripting CVSS 3.1MEDIUM 5.4
Sources
- CVE-2022-4611 · CVE Program
- CVE-2022-4611 · NVD
- FIRST EPSS
- GHSA-gc6m-vvjp-f3xm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences