A critical flaw in N-able's Passportal password manager allowed any website — including ones with malicious ads — to silently steal a user's entire password vault. Researcher James Arnott of Bay Area Labs discovered on July 8 that Passportal's browser extension trusted messages from any source without verification, handing over access tokens to anyone who asked.
Those tokens unlock everything: stored credentials, one-time passwords, and with a 100-day refresh token, persistent access long after the initial breach. N-able patched the issue the next day, but the core problem remains — Passportal still decrypts passwords on its own servers rather than locally, leaving users exposed to future attacks.
With roughly 2,500 MSPs using the product, a single compromised account could cascade across dozens of client organizations.
Source: Dark Reading