VULNERABILITY INTELLIGENCE
CVE-2026-15580
CVSS score6.9 MEDIUM
EPSS probability0.25%
CISA KEVNot currently listed
Published2026-08-21
Last modified2026-10-15
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.
Weakness classification
- CWE-1385: Missing Origin Validation in WebSockets