Passwordstate dev urges users to patch auth bypass vulnerability

Passwordstate’s developer, Click Studios, has urged customers to patch a high-severity authentication bypass vulnerability in Passwordstate as soon as possible. According to Click Studios, the flaw can be exploited via a carefully crafted URL on the core Emergency Access page to bypass authentication and access the Passwordstate Administration section, and it ships with Passwordstate 9.9 Build 9972, released today with two security updates.

The company notes there is no CVE ID for the flaw, and it has provided a short-term workaround for those unable to upgrade immediately by configuring the Emergency Access Allowed IP Address under System Settings->Allowed IP Ranges. Passwordstate is used by more than 370,000 IT professionals at 29,000 companies worldwide, including government and financial organisations, underscoring the potential impact of any compromise.

The disclosure echoes a prior incident four years ago when attackers targeted Passwordstate’s update mechanism with the Moserpass malware in a supply-chain attack, which led to discussions about resetting passwords for affected customers.