Click Studios Patches Passwordstate Authentication Bypass Vulnerability in Emergency Access Page

Click Studios has released Passwordstate 9.9 (Build 9972) to address an authentication bypass vulnerability on the core Emergency Access page, with the fix dated 28 August 2025. The issue, which is yet to be assigned a CVE identifier, was described by the company as a potential Authentication Bypass when using a carefully crafted URL against Passwordstate’s Emergency Access page.

The update also includes improved protections against potential clickjacking attacks on its browser extension, following findings by security researcher Marek Tóth about DOM-based extension clickjacking. According to Click Studios, the credential manager is used by 29,000 customers and 370,000 security and IT professionals across global enterprises, government agencies, financial institutions, and Fortune 500 companies.

The disclosure comes four years after a supply chain breach in 2021 that enabled attackers to hijack Passwordstate’s update mechanism to drop malware, and it recalls a December 2022 resolution of multiple security flaws, including an API authentication bypass (CVE-2022-3875) that could have exposed plaintext passwords.