---
title: N-able's Passportal Exposed Complete Customer Password Vaults to Any Website
description: A flaw in N-able's Passportal exposed users' password vaults to theft; new patch issued but core security risks remain.
canonical_url: https://codekeeper.co/ticker/n-able-passportal-flaw-exposes-passwords
---

# N-able's Passportal Exposed Complete Customer Password Vaults to Any Website

A flaw in N-able's Passportal exposed users' password vaults to theft; new patch issued but core security risks remain.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 21, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A critical flaw in N-able's Passportal password manager allowed any website — including ones with malicious ads — to silently steal a user's entire password vault. Researcher James Arnott of Bay Area Labs discovered on July 8 that Passportal's browser extension trusted messages from any source without verification, handing over access tokens to anyone who asked. Those tokens unlock everything: stored credentials, one-time passwords, and with a 100-day refresh token, persistent access long after the initial breach. N-able patched the issue the next day, but the core problem remains — Passportal still decrypts passwords on its own servers rather than locally, leaving users exposed to future attacks. With roughly 2,500 MSPs using the product, a single compromised account could cascade across dozens of client organizations. **Source:** [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/n-able-bug-password-vault-master-keys)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fn-able-passportal-flaw-exposes-passwords%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks ASOS App Hijacked by Hackers to Send Extortion Message Oct 7, 2026](https://codekeeper.co/ticker/asos-cyberattack-xuanye-group-threat)

[North Korea Used Obscure npm Package as a Dress Rehearsal Before the Axios Hack Aug 11, 2026](https://codekeeper.co/ticker/north-korean-hackers-target-npm-packages)

[Cyberattacks Three Banking Trojans — Manic, Grandoreiro, and ToxicPanda 2.0 — Are Actively Targeting Users Worldwide Aug 24, 2026](https://codekeeper.co/ticker/dangerous-banking-trojans-targeting-europe-and-latin-america)

[Data breaches Named Clients Deny They're in the 153M Driver's License Breach Sep 14, 2026](https://codekeeper.co/ticker/idscan-data-breach-exposes-153-million-licenses)