CVE-2026-15580: PassPortal browser extension: vault token disclosure via unvalidated postMessage
Published Aug 21, 2026
·Updated
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.
This issue affects the PassPortal browser extension: before 3.49.6.
Affected Software
1 affected component
N-able PassPortal browser extension<3.49.6
Event History
Aug 21, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
Which installations are affected?
N-able PassPortal browser extension versions earlier than 3.49.6 are affected.