N

The popular "Passportal" password manager, favored by MSPs and SMBs, remains risky even after its patch, thanks to its cloud-based design. Should these products stay away from the cloud entirely?

Unwise design choices from a specialty password manager allowed any malicious website to obtain complete, persistent access to customers' vaults.

"Passportal" is a credential management product from N-able, formerly SolarWinds MSP, a now-independent and nearly billion-dollar public company. N-able markets its products primarily to managed service providers (MSPs) and IT services providers, and according to its website , Passportal is used by around 2,500 managed service providers (MSPs) and 165,000 small and medium-sized businesses (SMBs).

Those organizations should be wary, though, because since their password manager operates over the cloud, their ultra-sensitive secrets are potentially vulnerable to Web-based exploits. On July 8, Bay Area Labs founder James Arnott discovered that Passportal accounts — and all of the credentials they manage — can be completely compromised by any website the user visits. The vendor implemented a patch the day, but even the updated product carries some risk for users, Arnott tells Dark Reading.

Most mainstream password managers perform their most sensitive functions on a local machine to reduce the risk that Web-based attackers can get to passwords. It's fairly simple: The master password generates a secret key that decrypts the otherwise scrambled, stored passwords, and that key stays with the user at all times. Any website a person logs in to only sees the product of the decryption process — i.e., plaintext passwords.

Passportal does things differently. Its master passwords generate access and refresh tokens, the former of which carries the secret key. When an employee wants to log in to a website, the access token travels to N-able's servers, N-able uses it to unscramble the login information into plaintext, and then it sends the password back to the user (with TLS encryption during transit) so the person can log in. But what if a hacker somehow inserts themselves into this process and nabs the access token for themselves?

That turned out not to be so difficult. Bay Area Labs found that Passportal's browser extension was entirely undiscerning — it trusted every message it received, without bothering to check what website sent it and what its contents were. Thus, if an employee could be lured to visit a malicious website — or a legitimate one with a malicious ad or iframe injected — Passportal would unquestionably listen to whatever it had to say. If it said window.postMessage({ method: 'getPasswords' }, '*') , Passportal would unthinkingly with the access and refresh tokens.

With an access token, an attacker could enumerate and steal every single account credential in a Passportal vault. They could also obtain time-based, one-time passwords (TOTPs) as necessary to access all of an organization's most sensitive accounts.

The stolen refresh token is useful, too — it allows an attacker to obtain a new access token as soon as an existing one expires. Access tokens expire pretty quickly (it's why users have to reenter master passwords so often to log in to their password managers), but the Passportal refresh token lasts for 100 days.

Total, persistent password vault compromise is nothing to sniff at, but on top of that, one has to consider that Passportal is typically used by supply chain services providers . "Say, for example, an attacker could get access to one MSP that manages 50 organizations. That MSP would very likely have highly privileged access to all of their downstream clients," Arnott tells Dark Reading.

The risk expands significantly further when Passportal customers utilize its "branded password management as a service" (PMaaS) feature, " Site ." Site allows service providers to rebrand Passportal using their own brand iconography and then redistribute it downstream to their own clients. If a hacker steals the secret key for a Passportal customer, which itself sells Passportal to more customers, it stands to reason that those twice-removed customers would also be compromised, though Arnott didn't test this scenario in practice.

Mere hours after Arnott confirmed his findings, N-able deployed a patch: a simple fix consisting of a check that makes sure the browser extension is the origin of requests, not random websites or iframes.

Browser extensions like Passportal typically update automatically, outside of view and, frankly, outside of notice for most organizations. To ensure that no workstation in an organization falls behind, though, Arnott suggests that proactive administrators can perform version locking. "In the Google Workspace admin console, you can lock extensions in specific versions, and then they'll all update once you bump the version manually from the admin console," he explains.

Even updating across the board doesn't mean that customers are out of the woods, though. Passportal continues to perform server-side decryption. Because the patch did not implement end-to-end encryption (E2EE), Arnott says, user passwords can still be at risk.

"In my opinion, there is no good reason it decrypts the passwords on the server," he says. For one thing, relying on third-party servers makes the product slower and less reliable. More to the point, if a hacker breaches N-able or any of its customers, they can still glean Passportal key material in transit. "It just provides such a huge attack surface that other password managers typically don't have," Arnott warns.

At the end of the day, Arnott says, "If I found out my password manager didn't have end-to-end encryption, there's no way I would use it."

In response to a Dark Reading query on that front, N-able wrote, "We are committed to the ongoing security and integrity of Passportal and are continuously evaluating further hardening measures."

Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.

He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.

He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

What Every Enterprise Should Know Securing Cloud Assets In the Age of AI

The Dos and Don'ts of a Cybersecurity Awareness Month People Actually Remember

Building a Secure AI Strategy for the Enterprise

Is your AppSec program Mythos Ready?

Experts Explain How to Develop a Framework for Cyber-Fraud Fusion