CVE-2026-84699
Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Sep 1, 2026
Description
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected Products
| Product | Versions |
|---|---|
Team Password ManagerTeam Password Manager |
|
References
- https://teampasswordmanager.com/product
- https://teampasswordmanager.com/blog/chrome-extension-6.42.27-tpm-14.184.308/vendor-advisory
- https://teampasswordmanager.com/docs/changelog/release-notes
- VulnCheck Advisory: Team Password Manager before 14.184.308 Authentication Bypass in Password Resetthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.