CVE-2026-84699: Team Password Manager Auth Bypass Flaw

CVE-2026-84699 Overview

CVE-2026-84699 is an authentication bypass vulnerability in Team Password Manager versions prior to 14.184.308. The flaw resides in the local account password reset workflow, which fails to enforce authentication requirements. Unauthenticated remote attackers can trigger a password reset for any local account and subsequently authenticate as that user. The weakness is categorized as CWE-640: Weak Password Recovery Mechanism for Forgotten Password.

Given that Team Password Manager is used to store shared organizational credentials, successful exploitation can expose an entire vault of secrets to attackers.

Critical Impact
Unauthenticated attackers can reset local account passwords over the network and log in as arbitrary users, including administrators, gaining access to stored credential vaults.

Affected Products

Team Password Manager versions before 14.184.308
Local (non-federated) user accounts in Team Password Manager
Self-hosted Team Password Manager deployments exposing the reset endpoint

Discovery Timeline

2026-09-02 - CVE-2026-84699 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84699

Vulnerability Analysis

Team Password Manager provides a self-service password reset flow for local accounts. In versions before 14.184.308, the endpoint that processes reset requests does not validate that the requester holds a legitimate, single-use reset token bound to the target account.

Because authentication and token validation are missing, an attacker who can reach the application over the network can submit a crafted request that resets a chosen local user's password to an attacker-controlled value. The attacker then logs in through the standard authentication flow using the new password. No user interaction is required, and no prior credentials are needed.

The impact is significant because Team Password Manager stores shared credentials used across an organization. Compromise of a single administrator account can expose every project, group, and password entry the account can read.

Root Cause

The root cause is a broken password recovery mechanism [CWE-640]. The reset flow trusts client-supplied parameters instead of binding the reset action to a server-issued, time-limited, cryptographically random token delivered out-of-band. This design gap allows the reset state machine to be advanced without proving control of the account's email address.

Attack Vector

Exploitation occurs over the network against the Team Password Manager web interface. An attacker enumerates or guesses local usernames, issues a reset request, and completes the flow to set a new password. Because the vulnerability is reachable pre-authentication, any internet-exposed or attacker-reachable instance is at risk. See the VulnCheck Security Advisory for additional context.

No verified public exploit code is available at the time of publication. Refer to the Team Password Manager Blog Post for vendor commentary on the fix.

Detection Methods for CVE-2026-84699

Indicators of Compromise

Unexpected password reset events in Team Password Manager audit logs for local accounts, especially administrator accounts.
Successful logins immediately following a reset event from IP addresses not associated with the account owner.
Bulk enumeration of usernames or repeated requests against the reset endpoint from a single source.
Unexplained access to, or export of, stored password entries after a reset event.

Detection Strategies

Correlate application audit logs for password reset actions with subsequent authentication events and source IP addresses.
Alert on password resets targeting privileged Team Password Manager accounts outside of change-management windows.
Monitor web server access logs for requests to the reset endpoint that lack a preceding legitimate user-initiated flow.

Monitoring Recommendations

Forward Team Password Manager application logs and reverse-proxy access logs to a centralized SIEM for correlation.
Track credential vault read operations per user and baseline normal access patterns to detect anomalous bulk retrievals.
Enable alerts on new administrative sessions originating from previously unseen geolocations or ASNs.

How to Mitigate CVE-2026-84699

Immediate Actions Required

Upgrade Team Password Manager to version 14.184.308 or later without delay.
Restrict network exposure of the Team Password Manager web interface to trusted networks or VPN clients until patched.
Force a password rotation for all local accounts and audit recent reset events for evidence of abuse.
Rotate high-value credentials stored in the vault if unauthorized access cannot be ruled out.

Patch Information

The vendor addressed the authentication bypass in Team Password Manager 14.184.308. Refer to the Team Password Manager Changelog and the vendor blog post for release notes and upgrade guidance.

Workarounds

Place the application behind a reverse proxy or WAF that blocks unauthenticated access to the password reset endpoint until the upgrade is applied.
Restrict inbound access to the management interface using IP allow-lists at the network or load balancer layer.
Where feasible, disable local accounts and rely on federated identity providers (SAML, LDAP) that do not use the vulnerable reset flow.

bash

# Example nginx configuration to restrict the reset endpoint to trusted networks
location ~* ^/index\.php/(login|user/password_reset) {
    allow 10.0.0.0/8;      # internal network
    allow 192.0.2.0/24;    # admin jump hosts
    deny  all;
    proxy_pass http://tpm_backend;
}