N-able PassPortal EUVD-2026-63972

The victim must have the PassPortal browser extension (version before 3.49.6) installed and active in their browser, and must have an active, authenticated Vault session token held by the extension at the time of attack. The attack requires the victim to visit an attacker-controlled web page or any page capable of executing arbitrary JavaScript (e.g., via XSS), triggering the malicious postMessage. No special server-side configuration is required. Exploitation is limited by: (1) the user-interaction requirement - the victim must navigate to or load attacker-controlled content; (2) the need for an active Vault token in the extension's context, meaning the victim must be logged into a Vault-integrated PassPortal session; (3) the extension must be running in the same browser where the malicious page loads. There is no indication the attack works against the PassPortal web application independently of the browser extension.

The CVSS 4.0 base score of 6.9 reflects a network-reachable, low-complexity attack requiring user interaction (UI:A - the victim must visit a malicious page) with no privileges required and high confidentiality impact on the vulnerable system. The absence of integrity and availability impact is consistent with a pure token exfiltration scenario. There is no CISA KEV listing and no public POC identified, which tempers urgency somewhat, but the severity of the asset at risk - a Vault authentication token granting access to secrets stores - substantially elevates real-world consequence beyond what the base score conveys. EPSS data is not provided in available intelligence sources, so exploitation probability cannot be quantified. The attack is straightforward to construct for anyone familiar with browser extension postMessage abuse, a well-documented technique. Organizations where PassPortal is deployed to privileged MSP technicians managing many client environments face amplified blast radius: a single token disclosure could pivot into downstream client infrastructure. The user-interaction requirement is the primary limiting factor; drive-by delivery via phishing or malicious ad injection is realistic.

An attacker crafts a malicious web page containing JavaScript that sends a postMessage to the PassPortal browser extension without an origin check. When a PassPortal user - such as an MSP technician with an active Vault session - visits the page (e.g., via a phishing link or malicious advertisement), the extension responds to the unsolicited message with the active Vault authentication token. The attacker's page captures the token and forwards it to an attacker-controlled server, where it is immediately reused to authenticate to the victim's Vault instance and retrieve secrets. No public exploit code is identified at time of analysis, but the postMessage abuse technique is publicly well-understood.