A Flaw in N-able's Passportal Handed Any Malicious Website the Keys to Every Password a Business Stored

Key points

• On 8 July, researcher James Arnott discovered that any malicious website could silently steal all credentials stored in N-able's Passportal password manager.
• Passportal is used by roughly 2,500 managed service providers (MSPs) and 165,000 small and medium-sized businesses, making the potential blast radius unusually large.
• A stolen refresh token, valid for 100 days, would let attackers keep returning to a victim's vault even after login sessions expired.
• N-able shipped a patch on 9 July, but the researcher says the product's core design still leaves customer passwords exposed on the company's own servers.
• N-able said it is "continuously evaluating further hardening measures" but has not committed to a specific architectural fix.

Password managers are supposed to be the safest place a business can keep its login credentials. For tens of thousands of companies using N-able's Passportal, that assumption turned out to be wrong.

Passportal is a cloud-based password manager sold by N-able, formerly the managed-service arm of SolarWinds and now a publicly traded company approaching a billion dollars in annual revenue. The product is aimed at managed service providers (MSPs), meaning IT firms that handle the computer systems of dozens or hundreds of smaller client businesses on their behalf.

How did the flaw work?

The breach point was Passportal's browser extension, a small add-on that sits inside a web browser and helps employees log in to websites automatically. The extension had a critical design flaw: it accepted instructions from any webpage without checking whether that page was allowed to send them.

Most password managers do their most sensitive work locally, on the user's own computer. The master password (the one password that unlocks all the others) creates a secret key on-device, and that key never leaves the machine. Passportal works differently. When an employee wants to retrieve a stored password, the request travels to N-able's own servers, which unscramble the password and send it back.

To authorise those server calls, Passportal issued users an "access token", a kind of digital pass that proves the request is legitimate. Arnott's Bay Area Labs found that any website a user visited could send the browser extension a simple command and receive that access token in reply, no hacking required beyond getting someone to visit a page. A malicious advertisement on an otherwise legitimate site would have been enough.

With the access token in hand, an attacker could pull every stored username and password from the vault. They could also grab the stored codes used for two-factor authentication (the six-digit numbers that change every 30 seconds, designed as a second lock on accounts). And because Passportal also handed over a "refresh token", a secondary credential that generates fresh access tokens, an attacker could return to the vault every time the original pass expired, for up to 100 days.

Why does it matter that MSPs were the target?

One compromised MSP is rarely just one victim. A single IT firm might manage networks for 50 businesses. Passportal's own "Site" feature lets MSPs rebrand and resell the product to their own clients, so a breach could cascade two layers deep before it stops.

N-able issued a fix the day after Arnott reported the problem, first covered by Dark Reading. The patch checks that instructions to the browser extension come from the extension itself, not from a random website. Browser extensions normally update silently and automatically, but Arnott suggests IT administrators lock their organisation's extensions to a specific version through the Google Workspace admin console, then manually approve updates, so every machine in the organisation stays in sync.

Is the problem fully fixed?

Not entirely. The patch stops outside websites from grabbing tokens, but Passportal still decrypts passwords on N-able's servers rather than on the user's own device. That means the unscrambled passwords exist, briefly, on infrastructure that is not under the customer's control. If N-able's servers were ever breached, or if traffic were intercepted in transit, customer passwords could still be exposed. Arnott's verdict is blunt: if his own password manager did not use end-to-end encryption (where only the user's device ever sees the unscrambled password), he would stop using it immediately.

Businesses relying on Passportal should confirm their browser extensions have updated, audit which accounts are stored in the vault, and consider resetting passwords for the most sensitive systems as a precaution. If you are a customer of an MSP and are unsure whether they use Passportal, it is worth asking.