AliasVault browser extension: Passkey requests not bound to origin or RP ID
Summary
The AliasVault browser extension passkey provider does not verify that passkey requests come from the actual website or that the relying-party identifier matches it. A malicious website can submit forged origin and relying-party values and, if a victim approves the AliasVault passkey prompt for a site where a matching passkey is stored, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked and set as passkey provider, and the victim must approve the prompt, so it cannot happen silently. The AliasVault server, web application and mobile apps are not affected.
Affected
- AliasVault browser extension versions before 0.29.4
- Server, web application and mobile apps: not affected according to the vendor
Fixed in
- Fixed in AliasVault browser extension version 0.29.4 (fix commit a60d096)
Workaround
- Unknown. No vendor workaround is documented.
- Interim measure only: disable or remove the passkey provider in the extension if it is not required.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No evidence of exploitation in the wild and no public proof-of-concept found at the time of research.
Our recommendation
- Update the AliasVault browser extension to version 0.29.4 or later, and ideally the latest available release.
- Until updated, disable the passkey provider if passkeys are not needed.
- Only approve passkey prompts you initiated and that match the website you are on.
- Review which sites have stored passkeys in AliasVault and monitor for unexpected prompts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f99p-jfhr-6ffc github.com
- Fix commit a60d096 github.com
- AliasVault release 0.29.4 github.com
- Vulners CVE-2026-55587 vulners.com
- OpenCVE CVE-2026-55587 app.opencve.io
- VulDB 420797 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:58.
Original description (NVD)
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.