CVE-2026-15580 - PassPortal browser extension: vault token disclosure via unvalidated postMessage

Back Back to CVE browser

MEDIUM

PassPortal browser extension: vault token disclosure via unvalidated postMessage

Published Aug 21, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.19%

Description

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.

This issue affects the PassPortal browser extension: before 3.49.6.

Affected products

Vendor N-able Product PassPortal Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.49.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

N-able

PassPortal

unaffected

Version	Status	Constraints
0	affected	<3.49.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1385

References (1)

https://me.n-able.com/s/security-advisory/aArVy0000002GQTKA2/cve202615580-vault-token-disclosure-via-unvalidated-postmessage

Link	Providers	Tags
https://me.n-able.com/s/security-advisory/aArVy0000002GQTKA2/cve202615580-vault-token-disclosure-via-unvalidated-postmessage

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner N-able

Published Aug 21, 2026

Updated Aug 21, 2026

Reserved Jul 13, 2026

Link CVE-2026-15580

CISA Vulnrichment

Updated Aug 21, 2026

NVD

Status Awaiting Analysis

Modified Sep 8, 2026

Link CVE-2026-15580

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-15580