GitHub Advisoryadvisory · npm
GHSA-xfq4-78j7-v594 Passbolt Browser Extension leaks password information
MEDIUM
Official page ↗
- Aliases
- CVE-2024-33669
- Ecosystem
- npm
- Packages
- passbolt-browser-extension
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2025-06-19
Affected packages
• npm passbolt-browser-extension: < 4.6.2 → fixed in 4.6.2
Description
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
Related
Alias · CVE (1)
- CVE-2024-33669 An issue was discovered in Passbolt Browser Extension before 4.6.2. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-33669 advisory
- https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html web
- https://github.com/passbolt/passbolt_browser_extension package
- https://haveibeenpwned.com web
- https://www.passbolt.com web
- https://www.passbolt.com/incidents/pwned-password-service-information-leak web
- https://www.passbolt.com/security/more web