AliasVault Browser Extension Fixes Passkey Origin Binding Flaw in 0.29.4

AliasVault has released version 0.29.4 to address a high-severity vulnerability in its browser extension. The update fixes a flaw that failed to bind passkey requests to the actual webpage origin.

What happened

The National Vulnerability Database recorded CVE-2026-55587 with a CVSS score of 8.1, rating the severity as high. The issue stems from weakness CWE-346, involving an origin validation failure in cryptographic operations. Prior to version 0.29.4, the AliasVault browser extension passkey provider did not verify that the requested relying-party identifier matched the current website. This lack of binding meant the extension accepted passkey requests without confirming the source origin.

According to the NVD record, a malicious website could provide forged origin and relying-party values to the extension. If a victim with a matching stored passkey approved the AliasVault passkey prompt, the attacker could obtain a valid assertion for a different website. This effectively allowed the theft of authentication credentials for unrelated services. The server, web application, and mobile applications are not affected by this specific vulnerability.

Why it matters

The flaw compromises the security boundary between the browser extension and the websites it interacts with. Because the extension did not verify the relying-party identifier, it trusted inputs from malicious sites. This could lead to unauthorized access to accounts protected by passkeys stored in AliasVault. The vulnerability is rated high because it facilitates credential theft, a primary goal for attackers targeting password managers.

Exploitation requires specific conditions that limit silent abuse. The victim must have the extension installed, unlocked, and configured as a passkey provider. Additionally, the victim must possess a stored passkey for the impersonated site. Crucially, the victim must approve the passkey prompt, meaning the attack is not fully automated or invisible to the user.

What to watch

• Monitor for any new advisories regarding AliasVault or similar passkey providers.
• Check if other extensions in your environment have similar origin binding flaws.
• Review logs for unusual passkey authentication attempts from unexpected origins.
• Verify that all users have updated to version 0.29.4 or later.

Who needs to act first

Teams usually prioritize updating browser extensions on systems with high-value accounts. Check whether your organization uses AliasVault as a primary passkey provider. Roll out the update to exposed systems first, testing in a non-production environment to ensure compatibility. Back up extension configurations before applying the fix. If immediate updating is not possible, restrict access to untrusted websites. Educate users to scrutinize passkey prompts carefully. Verify that the extension is locked when not in use to reduce the attack surface.

Background: Passkeys

Passkeys replace passwords with public-key cryptography stored in your device’s secure hardware. They prevent credential stuffing and phishing because the private key never leaves your device. You authenticate using biometrics or a PIN, creating a frictionless yet secure login experience.

Read the full guide: Passkeys Explained: Why They Resist Phishing and Where They Fail

What to do and how to stay safe: AliasVault

• Update all AliasVault browser extensions to version 0.29.4 immediately.
• Verify that the extension is locked when not actively being used.
• Train users to inspect the origin of passkey prompts before approval.
• Monitor authentication logs for signs of forged passkey requests.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does CVE-2026-55587 affect the AliasVault mobile app?

No, the server, web application, and mobile applications are not affected by this vulnerability.

Can this flaw be exploited without user interaction?

No, exploitation cannot occur silently because the victim must approve the passkey prompt.

Which version fixes the passkey origin binding issue?

The issue is fixed in version 0.29.4 of the AliasVault browser extension.