Description
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
Published: 2026-10-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Theft
Action: Apply Patch
AI Analysis

Impact

The AliasVault browser extension allows passkey requests without validating the originating website or the relying‑party identifier. A malicious site can supply forged values, and if a user authorizes the prompt, the extension will return a valid assertion for a different site. This enables an attacker to authenticate as the victim on the impersonated site, effectively stealing credentials. The weakness represents an improper validation of external input (CWE‑346).

Affected Systems

The vulnerability affects the AliasVault browser extension prior to version 0.29.4. Any user with the extension installed, unlocked, and configured as a passkey provider, and with at least one stored passkey for the targeted site, is vulnerable. The server, web pages, and mobile apps are not impacted.

Risk and Exploitability

The CVSS score of 8.1 categorizes this flaw as high severity. However, the EPSS score is below 1%, indicating a low probability of exploitation in the near term. The bug is not listed in CISA’s KEV catalog. Because the attacker must first deceive the user into approving the passkey prompt, exploitation is not silent and requires user interaction, but the process is straightforward for a determined attacker with a malicious site.

Generated by OpenCVE AI on October 16, 2026 at 17:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade AliasVault to version 0.29.4 or later.
  • Disable or remove the AliasVault extension’s passkey provider if it is not required.
  • Educate users to verify that passkey prompts originate from legitimate sites and to only approve prompts when they are certain of the context.

Generated by OpenCVE AI on October 16, 2026 at 17:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Aliasvault
Aliasvault aliasvault
Vendors & Products Aliasvault
Aliasvault aliasvault

Thu, 15 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
Title AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID
Weaknesses CWE-346
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

Subscriptions

Aliasvault Aliasvault
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T20:01:30.746Z

Reserved: 2026-06-16T23:18:03.169Z

Link: CVE-2026-55587

cve-icon Vulnrichment

Updated: 2026-10-28T20:01:23.487Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T19:17:40.657

Modified: 2026-10-28T20:18:08.857

Link: CVE-2026-55587

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T17:15:11Z

Weaknesses