Paper/Archive/CVE-2026-84699

CVE-2026-84699

Team Password Manager Team Password Manager — Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

EPSS 0.6%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 50.2.502 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

Affected

ProductAffectedFixed inSource

Team Password Manager< 14.184.30814.184.308CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refteampasswordmanager.com advisoryteampasswordmanager.com/blog/chrome-extension-6.42.27-tpm-14.184.308 refteampasswordmanager.com/docs/changelog writeupvulncheck.com/advisories/team-password-manager-before-14.184.308-authentication-bypass-in-password-reset