Passportal
Monthly
Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.
Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.