CVE-2026-55587

Deferred Deferred - Pending Action

Passkey Provider Origin Validation Bypass in AliasVault

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55587

EUVD

EUVD-2026-102304

Affected Vendors & Products

Vendor	Product	Version / Range
aliasvault	aliasvault	< 0.29.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

CVE-2026-55587 is a vulnerability in the AliasVault browser extension where the passkey provider does not properly validate the origin or relying-party identifier during WebAuthn requests. This allows a malicious website to forge these values and trick the extension into generating a valid passkey assertion for a different site if the victim approves the prompt.

Detection Guidance

Detecting this vulnerability requires checking the installed version of the AliasVault browser extension. If the version is below 0.29.4, the system is vulnerable. For Chrome-based browsers, check chrome://extensions and look for AliasVault. For Firefox, check about:addons. Compare the version number against 0.29.4.

Impact Analysis

If exploited, this vulnerability could allow a malicious website to obtain a valid passkey assertion for another website where you have a stored passkey in AliasVault. This requires you to visit the malicious site, have the extension installed and unlocked, and manually approve the passkey prompt. The attack cannot happen silently.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by weakening WebAuthn's phishing resistance. A malicious site could trick users into approving passkey requests for unrelated domains where they have stored credentials, potentially leading to unauthorized access to sensitive data. This undermines authentication security measures required by these regulations.

Mitigation Strategies

Update the AliasVault browser extension to version 0.29.4 or later immediately. Disable the extension if an update is not available. Ensure no stored passkeys are used on untrusted websites. Monitor for suspicious authentication prompts.

Hi! I’m here to help you understand CVE-2026-55587. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70