ZeroDay Findings
Sign inSign up

Findings

CVE-2026-15580

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.

Published Aug 21, 2026 · updated Oct 15, 2026

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 21, 2026 · NIST NVD

    Detected

    vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

  2. Oct 15, 2026 · NIST NVD

    Updated

    vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

Sources

  • CVE.orgVulnerability recordCVE-2026-15580

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-15580

    vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

    nvd.nist.gov

References