A critical authentication bypass in Team Password Manager versions before 14.184.308 lets unauthenticated attackers reset local account passwords and log in as those users.
What Is It
Team Password Manager fails to enforce authentication requirements in its local account password reset flow. Because the reset path does not verify that the requester is authorized to act on the target account, an attacker with network access to the application can drive a password reset against a local account and then authenticate as that user.
The issue is tracked as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) and was disclosed via VulnCheck. It carries a CVSS 3.1 base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and a CVSS 4.0 score of 9.3 (Critical). Network attack vector, low complexity, no privileges, and no user interaction; with high confidentiality and integrity impact.
Why It Matters
The target is a password manager. Any account takeover here is not an endpoint; it is a pivot into whatever credentials that account holds. The scoring reflects the worst-case preconditions: an attacker needs nothing but reachability. No stolen credential, no phishing step, no victim click.
Confidentiality and integrity are both rated High: an attacker who completes the reset owns the account outright, able to read stored secrets and modify them. Availability is rated None, which means the scoring anticipates no degradation of service; it says nothing about how visible the intrusion is. A forced password reset locks the legitimate user out of their own account and is likely to be noticed; defenders should treat reset events on local accounts as a detection opportunity rather than assuming this plays out silently.
What's Vulnerable
- Vendor/Product: Team Password Manager
- Affected versions: all versions before 14.184.308
- Fixed in: 14.184.308
No CPE entries are published for this record yet.
Patch Status
Team Password Manager 14.184.308 addresses the flaw; the vendor documents the release alongside Chrome extension 6.42.27. Upgrade to 14.184.308 or later.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no KEV-mandated remediation deadline. Absence from KEV is not evidence that the flaw is unexploited, it only means CISA has not catalogued confirmed in-the-wild exploitation. The NVD record remains in "Received" status, meaning NVD enrichment is not yet complete, CVSS and CWE values shown here are the ones assigned by the disclosing party, VulnCheck.
Sources
- NVD, CVE-2026-84699
- VulnCheck Advisory; Team Password Manager before 14.184.308 authentication bypass in password reset
- Team Password Manager; Chrome Extension 6.42.27 / TPM 14.184.308 release notes
- Team Password Manager; Changelog
- Team Password Manager; Vendor site
- CISA, Known Exploited Vulnerabilities Catalog