--- title: N-able Bug Exposes Password Vault Master Keys | daily.dev description: A vulnerability in N-able's Passportal password manager, used by roughly 2,500 MSPs and 165,000 SMBs, allowed any malicious website to steal access and refresh... canonical: https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: N-able Bug Exposes Password Vault Master Keys | daily.dev og:description: A vulnerability in N-able's Passportal password manager, used by roughly 2,500 MSPs and 165,000 SMBs, allowed any malicious website to steal access and refresh... og:url: https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto og:image: https://api.daily.dev/og/posts/fgzyqsjTO.png og:image:alt: N-able Bug Exposes Password Vault Master Keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # N-able Bug Exposes Password Vault Master Keys **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 0 upvotes · 0 comments ## Summary A vulnerability in N-able's Passportal password manager, used by roughly 2,500 MSPs and 165,000 SMBs, allowed any malicious website to steal access and refresh tokens containing the secret key needed to decrypt every stored credential. The browser extension trusted any postMessage request without verifying its origin, so a malicious ad, iframe, or site could request and receive full vault access, including TOTP codes. Stolen refresh tokens remained valid for 100 days. N-able patched the flaw within a day of disclosure by validating the message origin, but the product still performs decryption server-side rather than using end-to-end encryption, meaning a breach of N-able's infrastructure could still expose customer credentials. The risk is amplified for MSPs whose compromised vaults could cascade to dozens of downstream client organizations, especially those using Passportal's white-labeled 'Site' PMaaS offering. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the vulnerability in N-able Passportal's browser extension? The Passportal browser extension trusted any postMessage it received without verifying the sender's origin or content. A malicious website, ad, or iframe could send window.postMessage({method: 'getPasswords'}, '*') and receive back the user's access and refresh tokens, enabling full extraction of vault credentials and TOTP codes. Bay Area Labs founder James Arnott disclosed this on July 8, and N-able patched it the next day. _Teams auditing browser-extension trust boundaries can track disclosures like this one on daily.dev._ ### Does N-able Passportal use end-to-end encryption? No, Passportal decrypts passwords server-side rather than on the user's device. The master password generates access and refresh tokens; the access token is sent to N-able's servers, which decrypt the credentials and return them over TLS. Because decryption happens server-side, a breach of N-able or its customers could expose key material in transit, unlike password managers that keep decryption entirely local. _Evaluating password manager architecture trade-offs is easier when tracking security design critiques on daily.dev._ ### How long does a stolen Passportal refresh token remain valid? A stolen refresh token remains usable for 100 days, letting an attacker repeatedly obtain fresh access tokens even after the original one expires. This gives an attacker persistent access to a compromised Passportal vault well beyond the short lifespan of the access token itself, which is why the vulnerability was considered a total, persistent vault compromise. _Security teams weighing token lifetime risks in credential tools can follow coverage like this on daily.dev._ ## Similar posts on daily.dev - [LastPass says hackers stole customer data through a supply chain breach at Klue](https://daily.dev/posts/lastpass-says-hackers-stole-customer-data-through-a-supply-chain-breach-at-klue-cot1tyrco) · The Next Web · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-y2yzqqslm) · Schneier on Security · 0 upvotes · 0 comments - [Threat Brief: Mitigating Large-Scale Credential Attacks](https://daily.dev/posts/threat-brief-mitigating-large-scale-credential-attacks-m9e9r9hka) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"N-able Bug Exposes Password Vault Master Keys","url":"https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto"},"datePublished":"2026-08-20T17:40:58.732Z","dateModified":"2026-09-14T09:13:32.434Z","description":"A vulnerability in N-able's Passportal password manager, used by roughly 2,500 MSPs and 165,000 SMBs, allowed any malicious website to steal access and refresh...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/87ab9f541971ebfd91abd91b6e7a2c7c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/87ab9f541971ebfd91abd91b6e7a2c7c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,encryption","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"N-able Bug Exposes Password Vault Master Keys"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/n-able-bug-exposes-password-vault-master-keys-fgzyqsjto#faq","mainEntity":[{"@type":"Question","name":"What was the vulnerability in N-able Passportal's browser extension?","acceptedAnswer":{"@type":"Answer","text":"The Passportal browser extension trusted any postMessage it received without verifying the sender's origin or content. A malicious website, ad, or iframe could send window.postMessage({method: 'getPasswords'}, '*') and receive back the user's access and refresh tokens, enabling full extraction of vault credentials and TOTP codes. Bay Area Labs founder James Arnott disclosed this on July 8, and N-able patched it the next day. Teams auditing browser-extension trust boundaries can track disclosures like this one on daily.dev."}},{"@type":"Question","name":"Does N-able Passportal use end-to-end encryption?","acceptedAnswer":{"@type":"Answer","text":"No, Passportal decrypts passwords server-side rather than on the user's device. The master password generates access and refresh tokens; the access token is sent to N-able's servers, which decrypt the credentials and return them over TLS. Because decryption happens server-side, a breach of N-able or its customers could expose key material in transit, unlike password managers that keep decryption entirely local. Evaluating password manager architecture trade-offs is easier when tracking security design critiques on daily.dev."}},{"@type":"Question","name":"How long does a stolen Passportal refresh token remain valid?","acceptedAnswer":{"@type":"Answer","text":"A stolen refresh token remains usable for 100 days, letting an attacker repeatedly obtain fresh access tokens even after the original one expires. This gives an attacker persistent access to a compromised Passportal vault well beyond the short lifespan of the access token itself, which is why the vulnerability was considered a total, persistent vault compromise. Security teams weighing token lifetime risks in credential tools can follow coverage like this on daily.dev."}}]} ```