CVE-2026-55587 Details

A vulnerability exists in the AliasVault browser extension passkey provider, prior to version 0.29.4. The issue arises because passkey requests are not properly bound to the webpage origin or the relying-party identifier. This allows a malicious website to inject false origin and RP values. If a user with a stored passkey for the impersonated site approves the request, the extension can generate a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and set up as a passkey provider, as well as a stored passkey for the targeted site. The vulnerability cannot be exploited silently, as user approval is needed.

Users are advised to update the AliasVault browser extension to version 0.29.4 or later. The update includes a fix that validates the origin and relying-party information in passkey requests, ensuring they match the current website context. Instructions for downloading the updated extension are available on the AliasVault GitHub Releases page.