CVE-2026-15580
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.19%
- CWE
- CWE-1385
- Published
- 2026-08-21
- Last modified
- 2026-08-21
Affected products
- N-able PassPortal
Weakness type
Related vulnerabilities
- CVE-2026-85183 — Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- CVE-2026-59950 — MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CVE-2026-57111 — Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
- CVE-2026-59804 — Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
- CVE-2026-10054 — In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged...
- CVE-2026-44211 — Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
- CVE-2026-44514 — Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users
- CVE-2026-34403 — Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints