CVE-2026-15580: N-able Passportal Browser Extension Unvalidated-Origin Message Handling Steals Password Vaults and Live TOTP for 73,000 MSP Users

AmIBeingPwned publicly disclosed CVE-2026-15580 in the N-able Passportal Chrome/Edge extension, CVSS 9.4. Attackers can extract a logged-in user's password-vault entries and live TOTP codes via a malicious iframe on any page. Patch 3.49.6 shipped 24 hours after the report.

In August 2026, the AmIBeingPwned team disclosed a high-severity message-origin validation flaw in the N-able Passportal browser extension (Chrome / Microsoft Edge), tracked as CVE-2026-15580, CVSS v4.0 base score 9.4. N-able shipped version 3.49.6 within 24 hours of receiving the full report. Passportal is a privileged-access and password-management platform for MSPs and internal IT teams, with ~73,000 weekly active browser-extension users. The bug lets any malicious site a user visits—or an injected third-party iframe—steal the organization's entire password vault and TOTP codes.

Incident Overview

The Passportal browser extension uses window.postMessage as IPC between the content script and the extension iframe, but the message handler does not strictly validate origin. Any page that contacts a logged-in extension user (visited sites, ad iframes, third-party trackers) can forge postMessage requests; the extension replies with live identity tokens to the forged origin. With the token, an attacker can enumerate vault entries, request decrypted passwords, grab live TOTP codes, and persist a session for up to 100 days via refresh token. AmIBeingPwned also noted Passportal's server-side decrypt-and-return-plaintext architecture, which contradicts zero-trust cryptography practice and widens exposure.

Technical Details

CVE-2026-15580 trigger chain:

• Content script calls window.postMessage to talk to the extension iframe;
• Extension-side handler does not check event.origin, does not verify message signatures, and does not use a one-time nonce;
• Malicious site/JavaScript actively postMessages the target extension and requests decrypted passwords/TOTP;
• If the extension is already logged in, it returns tokens and plaintext data directly to the attacker-controlled origin;
• Passportal access tokens are JWTs carrying key material, not separately encrypted (JWT by default guarantees integrity, not confidentiality); leakage equals session-key leakage.

With the token, an attacker can:

• Enumerate all Passportal password entries (customer systems, remote servers, VPNs, internal SaaS apps);
• Pull live 6-digit TOTP for any entry and log into 2FA-protected internal systems, mailboxes, jump hosts;
• Maintain Passportal API access for up to 100 days via refresh token without returning to the browser, expanding blast radius;
• For MSP customers, a single extension victim yields remote-admin paths into every client system.

Impact Assessment

CVSS v4.0 scoring:

• AV:N (network), AC:L (low), PR:N (no privileges), UI:P (user action—visit a malicious page), S:U (unchanged), C:H/I:H/A:H → 9.4;
• Real-world preconditions (extension installed and logged in) are the default: MSP engineers keep the extension logged in nearly all day to do ops work.
• Exploit bar: one malicious page or a poisoned ad. Matches watering-hole + SEO-poison supply-chain paths.

More than half of Passportal customers are MSPs. Downstream clients often run tax, healthcare, and legal systems under high compliance. Compromise of one extension can cascade across multiple served enterprises.

Fix and Mitigation

Official fix (N-able Passportal 3.49.6):

• Strict origin checks and extension self-validation on all postMessage calls;
• Trusted-domain allowlist for iframe origins;
• One-time nonce required on the message-handling path;
• Audit the extension message channel; remove direct window.postMessage exposure.

Admin actions:

• Inventory Passportal extension versions on all Chrome / Edge / Firefox instances. Force upgrade to 3.49.6 or later. MDM-push remaining clients;
• Force-rotate passwords for high-tier customer systems, VPNs, domain registrars, mail platforms, AWS/Azure consoles, 3PAOs, and PCI-scope entries;
• Force-reset and re-enroll all TOTP seeds. Revoke refresh tokens issued in the last 100 days;
• 24–72h intensive watch: SIEM for bulk Passportal API enumeration, anomalous TOTP pull rates, offline refresh-token use;
• Fold browser-extension governance into enterprise browser policy. Critical-role staff may only run MDM-approved extensions.

Architecture Takeaways

AmIBeingPwned's public report notes that Passportal's server-side decrypt-and-return-plaintext architecture is a standing risk. Even after CVE-2026-15580 is patched, an attacker on the server-side decrypt path still gets plaintext passwords. Enterprise users should push vendors toward client-side E2EE decrypt models (1Password, Bitwarden already derive keys client-side with PBKDF2+Argon2 and decrypt there). Treat extension message channels as a first-order item in vendor security audits. Any extension that relies on window.postMessage without origin/nonce checks belongs in the high-risk bucket.

References

• HackersRadar: Critical N-able Passportal Flaw Exposes Password Vaults, 2FA Codes
• AmIBeingPwned: Passportal disclosure report
• ANZ Security Hub: critical alerts affecting N-able products
• Australian Cyber Security Centre ACSC Alerts
• CyberSecBrief: Daily Cybersecurity Briefing (21 August 2026)