Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck
CVE-2026-84699Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
Critical 9.1
In plain English
A critical-severity security flaw in Team Password Manager from Team Password Manager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.6%top 49.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Team Password Manager | Team Password Manager | 0 – before 14.184.308 |
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://teampasswordmanager.com/ product
- https://teampasswordmanager.com/blog/chrome-extension-6.42.27-tpm-14.184.308/ vendor-advisory
- https://teampasswordmanager.com/docs/changelog/ release-notes
- VulnCheck Advisory: Team Password Manager before 14.184.308 Authentication Bypass in Password Reset third-party-advisory