CVE-2026-12068
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Avira Password Manager has an information disclosure vulnerability that may allow a remote attacker to obtain credentials autofilled for the parent web page via incorrect autofill field selection in a cross-origin iframe.
Risk Assessment
This vulnerability could lead to unauthorized access to sensitive user data, posing a significant security risk to the organization.
Recommendation
It is recommended to update Avira Password Manager to the latest version and monitor the use of Mozilla Firefox in relation to this vulnerability.
Original NVD description (English source)
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.