Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.2

Passwordstate Emergency Access Can Be Bypassed by Crafted URL

CVE-2025-59453 · published 1 year ago
Summary

A vulnerability in Passwordstate allows an unauthorized person to access the administration section by using a specially crafted URL. This could allow them to view and edit sensitive data. We recommend Click Studios to update to version 9.9 Build 9972 or later to fix this issue.

Original advisory text
Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unautho...
Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.2 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-669Incorrect Resource Transfer Between Spheres
Timeline
Published16 Sep 2025
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-59453 · NVD
Track software like this
Free during beta