Skip to main content

If you use this free password manager, your passwords might be at risk

Researchers have just found a flaw within Bitwarden, a popular password manager. If exploited, the bug could give hackers access to login credentials, compromising various accounts.

The flaw within Bitwarden was spotted by Flashpoint, a security analysis firm. While the issue hasn’t received much — or any — coverage in the past, it appears that Bitwarden was aware of it all along. Here’s how it works.

Office computer with login asking for password and username.
Image used with permission by copyright holder

The potential security risk lies within Bitwarden’s autofill on page load feature. It lets inline frames (iframes) access your login details, and if said iframes are compromised, then so are your credentials. An iframe is an HTML element that allows developers to embed a different webpage within the page you’re currently on. They’re often used for the purpose of embedding ads, videos, or web analytics.

According to Flashpoint, using Bitwarden with autofill enabled on a page that contains iframes could result in password theft. This is because autofill on page load automatically fills out your login and password both on the page you’re on and within the iframe — and that exposes you to certain risks.

In its report, Flashpoint said: “While the embedded iframe does not have access to any content in the parent page, it can wait for input to the login form and forward the entered credentials to a remote server without further user interaction.”

There’s another way hackers could steal your passwords, though. Bitwarden’s autofill on page load also works on subdomains of the domain you’re trying to access, as long as the login matches. This means that if you stumble upon a phishing page, with a subdomain that matches the base domain you’ve saved your password for, Bitwarden might automatically provide it to the hacker.

“Some content hosting providers allow hosting arbitrary content under a subdomain of their official domain, which also serves their login page. As an example, should a company have a login page at and allow users to serve content under https://<clientname>.company.tld, these users are able to steal credentials from the Bitwarden extensions,” Flashpoint explained.

A dark mystery hand typing on a laptop computer at night.
Andrew Brookes / Getty Images

This problem won’t crop up on legitimate, large websites, but free hosting services allow for such domains to be made. Still, both flaws have a pretty small chance of occurring, which is why Bitwarden hasn’t fixed the issue despite being aware of it. In order to keep working on websites that use iframes, Bitwarden has to leave this window of opportunity open for possible phishing and password theft.

It’s worth noting that autofill on page load is disabled in Bitwarden by default, and the tool does warn users about the possible risks when they turn the feature on. In response to the report, Bitwarden has said it’s planning an update that will block autofill on subdomains.

If you’re not using a tool like Bitwarden yet, make sure to check out our guide to the best password managers. Bitwarden is on that list, and despite this security flaw, it still deserves its place — but perhaps disabling autofill on page load might be a good idea for the time being.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
Hackers are using a devious new trick to infect your devices
A person using a laptop with a set of code seen on the display.

Hackers have long used lookalike domain names to trick people into visiting malicious websites, but now the threat posed by this tactic could be about to ramp up significantly. That’s because two new domain name extensions have been approved which could lead to an epidemic of phishing attempts.

The two new top-level domains (TLDs) that are causing such consternation are the .zip and .mov extensions. They’ve just been introduced by Google alongside the .dad, .esq, .prof, .phd, .nexus, .foo names.

Read more
No, 1Password wasn’t hacked – here’s what really happened
A person using the 1Password password manager on a laptop while sat on a couch.

Password managers have been struggling with security breaches in recent months, with LastPass suffering a particularly bad hack as a notable example. So when 1Password users got an alert last week saying their Secret Keys and passwords had been changed without their knowledge, they were understandably panicked. Luckily, all was not what it seemed.

That’s because AgileBits, the company behind 1Password, has just explained exactly what went wrong during that event. And while it wasn’t as bad as everyone first thought, it still doesn’t paint AgileBits in a particularly good light.

Read more
OpenAI threatens lawsuit over student GPT-4 project, forgets you can use it for free
OpenAI's ChatGPT blog post is open on a computer monitor, taken from a high angle.

There's nothing quite like the nonprofit research group turned for-profit company OpenAI chasing down a computer science student over an open-source GPT-4 project. Sounds ridiculous, but it's true. The creators of ChatGPT are threatening a lawsuit against student Xtekky if he doesn't take down his GPT4free GitHub repository.

As reported by Tom's Hardware, GPT4free is an open-source project from a European computer science student. The student identifies as Xtekky, and his tool pings various websites that use GPT-4. You can clone the repository, set up the chatbot locally on your PC, and interact with GPT-4 without paying for OpenAI's ChatGPT Plus service.

Read more