CVE-2026-55587

Name of the Vulnerable Software and Affected Versions AliasVault versions prior to 0.29.4

Description The browser extension passkey provider fails to bind passkey requests to the actual webpage origin and does not verify if the requested relying-party identifier matches the current website. This allows a malicious website to provide forged origin and relying-party values. If a user approves the prompt while having a matching stored passkey, the attacker can obtain a valid assertion for a different website. This requires the extension to be installed, unlocked, and configured as a passkey provider, and the user must manually approve the prompt.

Recommendations Update to version 0.29.4.