Click Studios Passwordstate API authentication bypass by assumed-immutable data

published 2022-12-19 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-43211

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-04-14)

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

modzero.com https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html referenced PoC, tagged "exploit" by a source, unverified
modzero.com https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Click Studios Passwordstate
Click Studios Passwordstate Browser Extension Chrome

Classification

Weakness

CWE-302 Authentication Bypass by Assumed-Immutable Data
CWE-287 Improper Authentication

References

modzero.com /modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
exploit, technical-description, third-party-advisory
modzero.com /static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
exploit, third-party-advisory
vuldb.com /?id.216244
third-party-advisory, vdb-entry

Sources

CVE List CVE-2022-3875
NVD CVE-2022-3875

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary