Password managers keep your passwords safe, unless…

Researchers demonstrated that cloud-based password managers' design and legacy compatibility choices—shared group keys, server-controlled recovery policies, downgradeable KDF iterations, and support for non‑AEAD modes—could allow a compromised or malicious server to recover vault keys and plaintext in targeted attacks; while attacks require a high level of compromise and many issues have been patched, users and organizations should enable MFA, avoid legacy clients/features, and apply vendor mitigations promptly.