This vulnerability (CWE-1385) in N-able PassPortal's browser extension allows an attacker to disclose vault tokens due to missing origin validation in WebSocket communications. The issue arises from unvalidated postMessage handling, which can be exploited to abuse authentication mechanisms. The affected versions are all versions before 3.49.6. The CVSS 4.0 base score is 6.9, indicating a medium severity risk. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to disclosure of vault tokens, enabling authentication abuse. This could allow unauthorized access to sensitive credentials managed by the PassPortal extension. However, there is no indication of remote code execution or system compromise beyond authentication abuse. The vulnerability requires user interaction (UI:A) and has a high impact on confidentiality (VC:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted web content that might exploit the postMessage interface. Monitoring for vendor updates is recommended.