CVE-2026-15580: CWE-1385 Missing origin validation in WebSockets in N-able PassPortal

The vulnerability identified as CVE-2026-15580 affects the N-able PassPortal browser extension versions before 3.49.6. It is caused by missing origin validation in WebSockets, which allows an attacker to exploit an unvalidated postMessage vulnerability. This results in the disclosure of vault tokens, potentially enabling authentication abuse. The CVSS 4.0 base score is 6.9, indicating a medium severity level. There is no indication of active exploitation in the wild, and no official patch links are provided in the input data.

Successful exploitation of this vulnerability can lead to disclosure of vault tokens, which may allow an attacker to abuse authentication mechanisms within the PassPortal extension. This could compromise user credentials or session integrity. However, there is no evidence of known exploits in the wild at this time.

A fixed version is available starting from 3.49.6 of the PassPortal browser extension. Users and administrators should upgrade to version 3.49.6 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the updated extension version. Patch status is confirmed by the affectedVersions data indicating versions before 3.49.6 are vulnerable.