CVE-2026-15580: N-able PassPortal Auth Bypass Vulnerability

CVE-2026-15580 Overview

CVE-2026-15580 is a vault token disclosure vulnerability in the N-able PassPortal browser extension. The flaw stems from an unvalidated postMessage handler that fails to verify the origin of incoming messages. An attacker who convinces a user to visit a malicious page can retrieve the vault token from the extension. Once disclosed, the token enables authentication abuse against the PassPortal password vault. The issue affects all versions of the PassPortal browser extension before 3.49.6. This vulnerability maps to CWE-1385: Missing Origin Validation in WebSockets.

Critical Impact
Disclosure of vault tokens permits attackers to abuse authenticated sessions and access credentials stored in the PassPortal vault.

Affected Products

N-able PassPortal browser extension versions before 3.49.6

Discovery Timeline

2026-08-21 - CVE-2026-15580 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-15580

Vulnerability Analysis

The PassPortal browser extension communicates between its content script and page context using the window.postMessage API. The extension listens for messages but does not validate the event.origin or event.source properties before processing the payload. Any script running in a page the user visits can send a crafted message to the extension and receive the vault token in response.

Browser extensions that broker access to secrets require strict origin checks on cross-context messaging. When those checks are absent, the security boundary between untrusted web content and the trusted extension collapses. The consequence for PassPortal is direct exposure of the token that authenticates the user to the vault.

Root Cause

The root cause is missing origin validation on postMessage events received by the extension [CWE-1385]. The handler processes any incoming message and returns sensitive data without confirming the sender is the trusted extension context or a permitted origin.

Attack Vector

Exploitation requires the target user to load attacker-controlled web content while the vulnerable PassPortal extension is installed and active. The attacker's page posts a message to the extension requesting or triggering vault token exposure. The extension responds without origin checks, and the malicious script exfiltrates the token to an attacker-controlled endpoint. The vector is network-based with user interaction required, but no privileges are needed on the target.

For implementation-level details, see the N-able Security Advisory for CVE-2026-15580.

Detection Methods for CVE-2026-15580

Indicators of Compromise

Outbound HTTP requests from browser processes containing PassPortal vault token values or Authorization headers to unexpected domains.
Browser extension telemetry showing postMessage traffic between untrusted page origins and the PassPortal extension content script.
PassPortal audit logs recording vault access from unusual client IP addresses, user agents, or geographies.

Detection Strategies

Inventory installed PassPortal browser extension versions across managed endpoints and flag any version below 3.49.6.
Monitor for anomalous PassPortal API authentication events, particularly reuse of the same vault token from multiple sources.
Correlate web browsing telemetry with extension activity to identify pages that interact with the PassPortal extension via postMessage.

Monitoring Recommendations

Enable and centralize PassPortal application audit logs for vault access, credential retrieval, and session events.
Alert on session token reuse across disparate network locations within short time windows.
Track browser extension version drift as part of endpoint compliance reporting.

How to Mitigate CVE-2026-15580

Immediate Actions Required

Upgrade the PassPortal browser extension to version 3.49.6 or later on all endpoints.
Rotate PassPortal vault credentials and API tokens for users who ran vulnerable extension versions.
Force reauthentication of active PassPortal sessions to invalidate any tokens that may have been disclosed.

Patch Information

N-able has released PassPortal browser extension version 3.49.6, which addresses the missing origin validation on postMessage events. Refer to the N-able Security Advisory for CVE-2026-15580 for the vendor's remediation guidance.

Workarounds

Restrict use of the PassPortal browser extension to trusted, business-only browsing profiles until patched.
Enforce browser policies that block installation of vulnerable extension versions via managed browser configuration.
Instruct users to avoid untrusted websites while the extension is active if immediate patching is not feasible.

bash

# Example: enumerate installed Chrome extension versions on Windows endpoints
# Adjust extension ID to match the deployed PassPortal extension
Get-ChildItem -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions" -Recurse -Filter manifest.json |
  ForEach-Object {
    $m = Get-Content $_.FullName | ConvertFrom-Json
    [PSCustomObject]@{ Path = $_.FullName; Name = $m.name; Version = $m.version }
  } | Where-Object { $_.Name -match 'PassPortal' }