{"id":"CVE-2026-15580","title":"vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.\n\nThis issue affects the PassPortal browser extension: before 3.49.6.","summary":"vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.\n\nThis issue affects the PassPortal browser extension: before 3.49.6.","severity":"none","cwe":["CWE-1385"],"published":"2026-08-21","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:16:41.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15580","references":[{"url":"https://me.n-able.com/s/security-advisory/aArVy0000002GQTKA2/cve202615580-vault-token-disclosure-via-unvalidated-postmessage","label":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"tags":["nvd"],"epss":0.0019,"epssPercentile":0.08865,"ingestedAt":"2026-09-08T20:10:03.157Z","slug":"CVE-2026-15580","body":"## Overview\n\nvault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.\n\nThis issue affects the PassPortal browser extension: before 3.49.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}