N-able Passportal Vulnerability Exposes User Credentials

A vulnerability in N-able's Passportal password manager allows any malicious website to gain complete access to user credentials for up to 100 days. The issue, identified by Bay Area Labs, stems from the browser extension's failure to validate the origin of messages, enabling attackers to exploit access tokens. The vulnerability affects approximately 73,000 weekly active users and has been assigned CVE-2026-15580. N-able patched the issue within 24 hours of being notified, but the design flaws raise ongoing security concerns. Users are advised to remain vigilant as the cloud-based architecture may still pose risks. The vulnerability was discovered on July 8, 2026.

Key Points: • N-able's Passportal vulnerability allows unauthorized access to user credentials. • Approximately 73,000 users are affected, with a CVSS score of 9.4. • N-able issued a patch within 24 hours of the vulnerability being reported.