CVE-2025-1987 Overview
CVE-2025-1987 is a stored Cross-Site Scripting (XSS) vulnerability in the Psono-Client password manager, as used in Bitdefender SecurePass. The client fails to sanitize the URL field within vault entries of type website_password and bookmark. An attacker can craft a malicious entry containing a javascript: URL, or trick a user into importing one. When the user clicks or opens the entry, the payload executes JavaScript inside the vault application context. The vulnerability is classified under [CWE-79] and affects the web client and browser extensions across Chrome, Edge, Firefox, and Safari.
Critical Impact
Successful exploitation gives attackers arbitrary code execution in the victim's browser session, exposing the entire password vault and stored credentials.
Affected Products
- Esaqa Psono-Client (all versions prior to patch)
- Bitdefender SecurePass Web Client
- Bitdefender SecurePass browser extensions for Chrome, Edge, Firefox, and Safari
Discovery Timeline
- 2025-06-21 - CVE-2025-1987 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1987
Vulnerability Analysis
The flaw resides in how Psono-Client renders the URL field associated with saved vault items. Vault entries of type website_password and bookmark accept arbitrary strings in the URL attribute. The client treats these strings as trusted navigation targets when the user interacts with an entry. Because the client does not validate the URL scheme, javascript: URIs are accepted and executed. The result is a stored XSS primitive that persists inside the encrypted vault and fires each time the entry is opened.
Root Cause
The root cause is missing input sanitization and output encoding on the URL field. The client trusts user-supplied vault data at render and click-through time. It does not enforce an allowlist of safe URL schemes such as http: or https:. Any string prefixed with javascript: is treated as a valid destination.
Attack Vector
An attacker exploits this remotely by delivering a malicious vault entry to the victim. Delivery vectors include shared vault items, malicious import files, or social engineering that convinces the user to add a bookmark. Once the entry exists in the vault, user interaction such as clicking the entry triggers execution. The script runs in the same origin as the vault UI, allowing the attacker to read decrypted secrets, exfiltrate credentials, or issue authenticated API calls to the Psono backend.
The vulnerability manifests when the client dereferences the unsanitized URL field. See the Bitdefender Security Advisory for technical details.
Detection Methods for CVE-2025-1987
Indicators of Compromise
- Vault entries where the URL field begins with javascript:, data:, or vbscript: instead of standard http:// or https:// schemes.
- Unexpected outbound HTTP requests from the browser extension origin to attacker-controlled domains.
- Vault import events originating from untrusted sources or shared links.
Detection Strategies
- Audit exported vault contents and shared items for entries whose URL field contains non-HTTP schemes or embedded script payloads.
- Monitor browser extension telemetry for anomalous script execution or DOM modifications inside the Psono/SecurePass origin.
- Correlate password manager access events with unusual credential retrieval bursts that could indicate mass vault exfiltration.
Monitoring Recommendations
- Enable browser and endpoint logging for extension activity tied to the SecurePass and Psono origins.
- Alert on any vault sharing or import operation from external users, particularly those containing HTML or script-like content.
- Track EPSS trend data for CVE-2025-1987 (currently 0.485%) and re-evaluate risk if exploit availability changes.
How to Mitigate CVE-2025-1987
Immediate Actions Required
- Update Psono-Client and Bitdefender SecurePass web client and browser extensions to the latest vendor-provided versions.
- Review vault contents for existing entries containing javascript: or other non-standard URL schemes and remove them.
- Revoke and rotate credentials stored in any vault exposed to untrusted shared entries prior to patching.
Patch Information
Bitdefender has published a fix and remediation guidance in the Bitdefender Security Advisory. Users of upstream Psono-Client should apply the corresponding Esaqa release. The patch enforces URL scheme validation on website_password and bookmark entry types.
Workarounds
- Disable vault sharing and import features until all clients are patched.
- Instruct users not to click URL links on vault entries received from untrusted parties.
- Restrict browser extension permissions and apply strict Content Security Policy headers on any self-hosted Psono deployment.
# Example Content Security Policy header for self-hosted Psono web client
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
