N-able Bug Exposes Password Vault Master Keys

A researcher discovered that the Passportal browser extension trusted window.postMessage calls from any website or iframe, allowing malicious sites to obtain access and refresh tokens that enable theft of all stored credentials and TOTPs from customer vaults; N-able patched the extension to verify request origin, but the product still decrypts data server-side (no E2EE), raising ongoing supply-chain and large-scale compromise concerns for MSPs and their downstream clients.