CVE-2026-84699

CVSS 9.3 (critical) · published 2026-09-02

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

Weakness: CWE-640

Source: NVD CVE-2026-84699

References

• https://teampasswordmanager.com/
• https://teampasswordmanager.com/blog/chrome-extension-6.42.27-tpm-14.184.308/
• https://teampasswordmanager.com/docs/changelog/
• https://www.vulncheck.com/advisories/team-password-manager-before-14.184.308-authentication-bypass-in-password-reset

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.