CVE-2026-84699

critical · 9.3

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

9.3

CVSS

0.6%

EPSS (exploit prob.)

50th

EPSS percentile

2026-09-02

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-640

References

https://teampasswordmanager.com/
https://teampasswordmanager.com/blog/chrome-extension-6.42.27-tpm-14.184.308/
https://teampasswordmanager.com/docs/changelog/
https://www.vulncheck.com/advisories/team-password-manager-before-14.184.308-authentication-bypass-in-password-reset

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-84699