Read the docs
TI-2026-13111 Aliases CVE-2026-15580GHSA-6637-gh22-j6hq

PassPortal browser extension: vault token disclosure via unvalidated postMessage

Priority LOW 30CWE-1385Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix Fixed PassPortal (N-able): 3.49.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
N-ablePassPortalbefore 3.49.63.49.6Patch availableCNA
  • PassPortal VendorN-able Affected before 3.49.6 Fixed in 3.49.6 Patch available CNA

Remediation

  • Fix · CNA PassPortal (N-able) Fixed in 3.49.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15580
  2. 2026-10-03 Alias added: GHSA-6637-gh22-j6hq

References

Other 1

  • TI-2026-59007 pre-authentication remote code execution KEVCVSS 4.0CRITICAL 10.0
  • TI-2025-08126 Command injection in N-able N-central KEVCVSS 4.0CRITICAL 9.4
  • TI-2025-08125 Insecure deserialization in N-able N-central KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-15225 Incomplete patch leads to administrative account takeover KEVCVSS 4.0HIGH 8.2
  • TI-2026-15214 Unauthenticated administrative account takeover KEVCVSS 4.0HIGH 8.2
  • TI-2025-10725 N-central Multiple XXE Injection Vulnerabilities CVSS 4.0HIGH 8.4
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences