Team Password Manager before 14.184.308 does not enforce authentication when a user attempts to reset a local account password. Unauthenticated attackers can trigger the reset mechanism to change any user’s password and then authenticate with those new credentials. The weakness is a classic authentication bypass (CWE-640) that can lead to full compromise of the local account and the data protected by it.

All versions of Team Password Manager earlier than 14.184.308 are affected, including 14.184.307 and older releases.

The CVSS score of 9.3 indicates a critical severity. Because the exploit does not require any special privileges or pre‑existing authentication, the likelihood of abuse is high, although an EPSS score is not available. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of authentication requirements makes it an attractive target for attackers. Based on the description, the attack vector is likely local or remote via the browser extension’s UI, where an unauthenticated user can invoke the reset flow without verifying current credentials.