CVE-2026-55587 AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A maliciou...

CVE-2026-55587 AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A maliciou...

CVE-2026-55587

The AliasVault browser extension, prior to version 0.29.4 , contains a WebAuthn bridge vulnerability where it fails to bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origi...