Vulnerabilities in Password Managers Allow Hackers to View and Change Passwords

Researchers from ETH Zurich and USI published a peer-reviewed paper detailing 27 attack scenarios against cloud-based password managers (Bitwarden, LastPass, Dashlane, 1Password) that exploit cryptographic and design weaknesses—such as unauthenticated public keys, lack of ciphertext integrity, and KDF downgrades—to enable password and vault compromise; vendors were notified and are remediating the issues.