CVE-2026-55587High· 8.1▾ TwilightAliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested rely…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94621Medium· 6.3AliasVault is a privacy-first password manager with built-in email aliasing
CVE-2026-55842Medium· 5.4Scoold is a Q&A and a knowledge sharing platform for teams
CVE-2026-109829High· 7.4undici is an HTTP client library for Node.js
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2022-21505Medium· 6.7In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable
CVE-2026-96238Medium· 6.5Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.