CVE-2026-15580 — PassPortal browser extension: vault token disclosure via unvalidated postMessage

CVE-2026-15580

PassPortal browser extension: vault token disclosure via unvalidated postMessage PUBLISHED

Description (CNA)

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

Affected (CNA)

Vendor / product	Versions
N-able / PassPortal	affected 0 before 3.49.6

CWE

CWE-1385

References

https://me.n-able.com/s/security-advisory/aArVy0000002GQTKA2/cve202615580-vault-token-disclosure-via-unvalidated-postmessage

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.