AliasVault Browser Extension CVE-2026-55587

Exploitation requires a specific, non-default chain of conditions all drawn from the description: the AliasVault browser extension must be installed, unlocked, and explicitly configured as the active passkey provider; the victim must already have a stored passkey for the exact site being impersonated; and the victim must manually approve the AliasVault passkey prompt (UI:R), since the flow cannot occur silently. The vulnerability is confined to the browser extension's passkey provider - the server, web application, and mobile applications are explicitly stated to be unaffected, limiting the exposed surface. These limiting factors (mandatory user approval, provider configuration, and a pre-existing stored passkey for the target site) substantially constrain realistic exploitation despite the network attack vector.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.1 High) frames this as a remotely reachable, unauthenticated issue with high confidentiality and integrity impact, which on paper looks like a high priority. However, the required UI:R (the victim must actively approve the AliasVault passkey prompt) plus a chain of deployment preconditions materially lower the real-world risk below what the base score suggests. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation signals are the vendor advisory and patch commit. Given that the affected product is a niche open-source password manager and that successful exploitation requires a victim who has the extension installed, unlocked, configured as a passkey provider, holding a stored passkey for the impersonated site, AND manually approving a prompt, this is a genuine but conditional origin-validation weakness (CWE-346) rather than a mass-exploitable threat. Note the input Tags label this 'Denial Of Service', which conflicts with the CWE-346 classification and the C:H/I:H/A:N impact (no availability impact) - the DoS label appears incorrect and should be disregarded.

An attacker stands up a malicious website that presents forged origin and relying-party identifier values to the AliasVault browser extension's passkey provider. A victim who already has the extension unlocked and configured as a passkey provider visits the site and approves the resulting AliasVault passkey prompt, causing the extension to return a valid WebAuthn assertion scoped to a different, impersonated website the victim holds a passkey for. No public exploit code was provided; because AV:N/AC:L applies but UI:R is required, the attack is network-delivered yet cannot succeed silently without the victim's approval.