CVE-2022-3875 Click Studios Passwordstate API authentication bypass by assumed-immutable data

High 7.3 Published 19 Dec 2022 Updated 14 Apr 2025

Remote attackers can bypass authentication in Click Studios Passwordstate API due to assumed-immutable data, potentially gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-3875?

CVE-2022-3875 is a high-severity authentication bypass vulnerability in Click Studios Passwordstate, published on 19 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244.

Weakness: CWE-287, CWE-302

Which versions are affected by CVE-2022-3875?

It affects 1 product.

Products include Clickstudios Passwordstate.

How do I fix CVE-2022-3875?

No fix has been published for CVE-2022-3875 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-3875 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3875 exists.

Sources

Also known as GHSA-x4qc-6q9c-46qw.