N-able's Passportal Exposed Complete Customer Password Vaults to Any Website

A flaw in N-able's Passportal exposed users' password vaults to theft; new patch issued but core security risks remain.

Aug 21, 2026

ON THIS PAGE

A critical flaw in N-able's Passportal password manager allowed any website — including ones with malicious ads — to silently steal a user's entire password vault. Researcher James Arnott of Bay Area Labs discovered on July 8 that Passportal's browser extension trusted messages from any source without verification, handing over access tokens to anyone who asked.

Those tokens unlock everything: stored credentials, one-time passwords, and with a 100-day refresh token, persistent access long after the initial breach. N-able patched the issue the next day, but the core problem remains — Passportal still decrypts passwords on its own servers rather than locally, leaving users exposed to future attacks.

With roughly 2,500 MSPs using the product, a single compromised account could cascade across dozens of client organizations.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?