Authentication Bypass in Team Password Manager via Password Reset Flow

Team Password Manager versions prior to 14.184.308 are affected by a high-severity authentication bypass vulnerability, tracked as CVE-2026-84699. This flaw exists within the application's local account password reset mechanism, where the software fails to properly enforce authentication requirements. An unauthenticated remote attacker can exploit this weakness by submitting crafted requests to the password reset endpoint, effectively resetting the password for any local user account without knowing the current credentials. Successful exploitation results in complete account takeover, granting the attacker unauthorized access to sensitive stored credentials and administrative functions within the platform. Given the role of Team Password Manager in securing organization-wide secrets, this vulnerability presents a critical risk for credential exfiltration and lateral movement.

Impact

Successful exploitation of CVE-2026-84699 allows an unauthenticated attacker to gain full control over local user accounts. In an enterprise environment, this leads to the compromise of the organization's master password repository, resulting in the exfiltration of all stored credentials, potential unauthorized access to downstream systems, and the total loss of confidentiality regarding the organization's secrets management.

Recommendation

Prioritized actions for security and IT teams:

• Upgrade Team Password Manager to version 14.184.308 or later immediately to address CVE-2026-84699.
• Review web server access logs for anomalous POST requests targeting the local account password reset endpoint.
• Audit all local user accounts for unexpected password changes or unusual login activity originating from unrecognized IP addresses.