N-able Passportal Bug Exposed Vault Tokens for Thousands of Businesses

A critical vulnerability in N-able's Passportal browser extension recently allowed malicious websites to steal user access and refresh tokens, potentially exposing the entire contents of customer password vaults. The flaw created a direct path for attackers to seize the tokens required to unlock sensitive credentials and TOTP codes.

The vulnerability stemmed from an undiscerning postMessage listener within the extension. Any website could send a 'getPasswords' request to the Passportal extension and receive the user's access and refresh tokens in return. These stolen refresh tokens were particularly dangerous, as they provided persistent access to vaults for up to 100 days. N-able patched the specific extension bug within 24 hours of its discovery by James Arnott, founder of Bay Area Labs.

The MSP Supply Chain Risk

Passportal is a privileged access manager designed specifically for managed service providers (MSPs) and IT service providers. The scale of the potential impact is significant, as the tool is used by approximately 2,500 MSPs and 165,000 small and medium-sized businesses (SMBs). Because MSPs typically maintain high-level administrative access to dozens of downstream clients, a compromise of a single provider's vault can trigger a massive supply chain breach, allowing an attacker to pivot from one service provider into numerous client environments simultaneously.

The Danger of Server-Side Decryption

Security researchers warn that while the specific bug is fixed, the product's underlying architecture remains a systemic risk. Unlike most mainstream password managers, Passportal lacks end-to-end encryption (E2EE) and performs decryption on N-able's servers rather than locally on the user's machine.

This design means that tokens must be transmitted to the cloud to facilitate decryption. This creates a significantly larger attack surface than local-decryption models, making the platform a high-value target. James Arnott noted the severity of this architectural choice, stating, "If I found out my password manager didn't have end-to-end encryption, there's no way I would use it."

Future Hardening

In response to the incident, N-able stated that they are "committed to the ongoing security and integrity of Passportal" and are continuously evaluating further hardening measures. However, the incident underscores a broader industry tension between the convenience of cloud-managed privileged access and the security requirements of zero-trust architecture. Users and MSPs will need to monitor whether N-able moves toward a local-decryption model to eliminate the risk of server-side token theft.