Rotation, not a version bump, is what the 100-day figure asks for. The leak happened in the browser; the tokens are honoured by N-able's servers. An attacker who harvested an access and refresh pair from a victim running v3.49.5 does not care that the victim now runs v3.49.6, and the disclosure describes a patched extension release without describing revocation of tokens already issued [17][22].
What makes a stolen token worth that much is where Passportal put the crypto. The researchers report that the JWT access token itself carries the key material, under the fields "organization_key" and "phrase", and that decryption happens on N-able's servers, which return plaintext passwords and TOTP codes [13][12]. When they requested a password with decrypt=false, they could not open the result locally, which they read as evidence of a secret held server-side [14]. So the vendor's API is the decryption oracle and the token is the entry ticket [18]. That is the inverse of the end-to-end model the same write-up says every major password manager uses, where the server never sees the key [15].
It also sets the rotation scope. Because the server hands back TOTP codes as well as passwords [12], a token holder inside the window can mint working second factors [20]. Changing a password while leaving the vault-stored seed in place closes half the door. And the iframe was not handed credentials scoped to the current page: it got the tokens, which is why the researchers describe complete access to the decrypted vault [1]. Their earlier MultiPassword finding was narrower, limited to credentials sharing an eTLD with no whole-vault dump [16].
Scale is the part MSPs will feel. The extension had more than 73,000 affected weekly active users [3], on a product line N-able (formerly SolarWinds MSP) sells specifically to managed service providers [6]. Those seats belong to service providers rather than consumers, so the unit of loss is a provider's vault [23], and the finding carries a CVSS v4.0 base of 9.4 with CVE-2026-15580 reserved [2][5].
N-able's response was quick: the researchers asked for a test account on 6 July, had one on 8 July, and say a fix was published within 24 hours of their report [8][7]. That speed is also the reason anyone knows about this. The researchers say an automated pipeline flagged the pattern and they nearly dropped it because they could not verify anything without an account [21]. Vendors who do not hand out accounts get the quieter benefit of nobody checking.
