An unvalidated postMessage handler in the N‑able PassPortal browser extension permits an attacker to retrieve a vault token, which can then be used to impersonate authenticated users. The flaw is characterized as a CWE‑1385 vulnerability. The disclosed token gives an attacker the ability to perform actions under the victim’s credentials, potentially accessing sensitive data or services. This impact is limited to environments where the browser extension is installed and active.

The affected product is the N‑able PassPortal browser extension for web browsers. Versions earlier than 3.49.6 are vulnerable. The issue is specific to the extension’s message handling component; no other N‑able products are listed as affected.

The CVSS score of 6.9 indicates a medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. However, the likely attack vector is a malicious web page or injected script that sends a crafted postMessage to the extension, bypassing security checks. If an attacker succeeds, the exposed token can be used for authentication abuse. Organizations using PassPortal should treat this as a moderate risk, especially in environments with privileged vault access.