Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. (CVE-2026-84699)

The vulnerability identified as CVE-2026-84699 affects Team Password Manager prior to version 14.184.308. It involves a failure to enforce authentication during the local account password reset process. As a result, attackers without any prior authentication can reset passwords of local accounts and gain unauthorized access by authenticating as those users. The CVSS 3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access to the system. This compromises confidentiality and integrity of the affected accounts. Availability is not impacted.

A fix is available in Team Password Manager version 14.184.308. Users should upgrade to this version or later to remediate the vulnerability. No other mitigation guidance is provided or necessary as the vulnerability is addressed by the official patch.