TI-2026-74985 Aliases CVE-2026-55587

AliasVault browser extension passkeys accept forged origin and RP ID

LOW 36CWE-346Published 2026-10-15 · Updated 2026-10-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

The AliasVault browser extension passkey provider before 0.29.4 does not bind passkey requests to the webpage origin or check that the relying-party ID matches the current site (CWE-346). A malicious website can supply forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault prompt, obtain a valid assertion for a different website. The attack requires the extension to be installed, unlocked and configured as a passkey provider, plus a stored passkey for the impersonated site, and it cannot occur silently.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00148 4th percentileScored 2026-11-07

Fix Fixed aliasvault (aliasvault): 0.29.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
aliasvault	aliasvault	before 0.29.4	0.29.4	Patch available	CNA

aliasvault Vendoraliasvault Affected before 0.29.4 Fixed in 0.29.4 Patch available CNA

Remediation

Update the AliasVault browser extension to version 0.29.4, which fixes this issue. The server, web application and mobile applications are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA aliasvault (aliasvault) Fixed in 0.29.4

Timeline

2026-10-16 Threatist record created from CVE-2026-55587
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-28 CISA SSVC decision points changed

References

Other 3

TI-2026-02566 AliasVault App Backup aliasvault.xml backup CVSS 4.0LOW 2.0
TI-2026-21236 AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering CVSS 3.1CRITICAL 9.3
TI-2025-36905 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction CVSS 3.1HIGH 7.7
TI-2026-74994 Server-side request forgery in AliasVault favicon extraction CVSS 3.1MEDIUM 6.3
TI-2026-18221 AliasVault is Missing Origin Validation in Android Passkey Credential Provider CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences