What’s Vulnerable › Vulnerabilities

CVE-2026-84699: Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-23
• Weakness: CWE-640

Description

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

Affected products

• Team Password Manager: before 14.184.308 — fixed in 14.184.308

How to fix

Upgrade to a fixed version: Team Password Manager 14.184.308. Check the vendor advisory for mitigations.

References

• https://teampasswordmanager.com/
• https://teampasswordmanager.com/blog/chrome-extension-6.42.27-tpm-14.184.308/
• https://teampasswordmanager.com/docs/changelog/
• https://www.vulncheck.com/advisories/team-password-manager-before-14.184.308-authentication-bypass-in-password-reset

Get alerted when CVE-2026-84699 or the next vulnerability affects your stack