CVE-2026-55587: AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AliasVault browser extensionto a version that resolves this vulnerability.Fixed in 0.29.4
Event History
Frequently Asked Questions
Which AliasVault deployments are affected?
Only the AliasVault browser extension versions prior to 0.29.4 are affected, and exploitation requires the extension to be installed, unlocked, and configured as a passkey provider. The AliasVault server, web application, and mobile applications are not affected.
What must an attacker and victim do for exploitation to succeed?
A malicious website must submit forged origin and relying-party identifier values, and the victim must have a stored passkey for the site being impersonated. The victim must also approve the AliasVault passkey prompt; exploitation cannot occur silently.
What should users do if they use AliasVault for passkeys?
Update the AliasVault browser extension to version 0.29.4 or later. Until updated, treat unexpected passkey prompts—especially when visiting unrelated websites—as suspicious and do not approve them.