CVE-2026-55587
8.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-346
Impact
A malicious site can hijack valid passkey assertions for other domains if a user visits the site and approves the extension prompt. To pull this off, an attacker needs a victim with an unlocked AliasVault browser extension who already has a passkey stored for the target site and clicks to approve the authentication.
Root cause
The browser extension fails to validate that passkey requests and relying-party IDs match the actual calling webpage origin.
Affected systems
AliasVault browser extension versions prior to 0.29.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade the AliasVault browser extension to version 0.29.4 or later. If updating immediately is not possible, disable the extension's passkey provider feature or avoid approving unexpected passkey prompts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.