CVE-2022-32550

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-15 · updated 2026-06-17

Description

An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.

Affected products

1Password: from 7.0 before 7.9.3; from 7.0 before 7.9.5; from 7.0 before 7.9.6; from 7.0 before 7.9.829; from 8.0 before 8.7.1; from 8.0 before 8.8.0-94 — fixed in 7.9.3, 7.9.5, 7.9.6, 7.9.829, 8.7.1, 8.8.0-104
1Password In The Browser: before 2.3.4 — fixed in 2.3.4
1Password Command-Line: from 2.0.0 before 2.3.0 — fixed in 2.3.0
1Password Command Line Interface: from 1.0.0 before 1.12.5 — fixed in 1.12.5
1Password Connect: before 1.5.3 — fixed in 1.5.3
1Password Scim Bridge: before 2.3.2 — fixed in 2.3.2

How to fix

Upgrade to a fixed version: 1Password 7.9.3, 7.9.5, 7.9.6, 7.9.829; 1Password In The Browser 2.3.4; 1Password Command-Line 2.3.0; 1Password Command Line Interface 1.12.5; 1Password Connect 1.5.3; 1Password Scim Bridge 2.3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-32550 or the next vulnerability affects your stack