Major Security Flaws Found in Popular Password Managers

Major Security Flaws Found in Popular Password Managers

Independent Security Evaluators found some worrying flaws in popular password managers, but still suggest that you use one.

Password managers, which have been suggested to internet users from all cybersecurity experts, are convenient and ensure the security of your account, but what if they are the source of vulnerability? A new report suggests that these password managers may not be as secure as you might think.

Before you go and delete your password manager and revert all your passwords back to 123456, note that the researchers who found these vulnerabilities in the five most popular password managers, still think that you should use one. 

The Independent Security Evaluators (IES) note that password managers are still a good thing, but found that they contain some worrying flaws on the security front, such as storing the master password for the application in the PC's memory in plaintext form.

ISE evaluated 1Password, Dashlane, KeePass and LastPass on Windows 10 and found that in some cases, the master password could be found in plaintext - no better than storing the password in a document saved to your desktop, at least when it comes to a skilled hacker. 

"Using a proprietary, reverse engineering, too, ISE analysts were able to quickly evaluate the password managers' handling of secrets in its locked state," ISE said in an article about the flaws. "ISE found that standard memory forensics can be used to extract the master password and the secrets it's supposed to guard."

The organization said an urgent remedy is required to facilitate password managers effectively scrubbing out all data that could lead to a potential compromise of a users' accounts. 

While these flaws are present in the password managers you might use today, it is worth noting that a hacker would have to first gain access to your computer to exploit this vulnerability. ISE says that password managers "add value to the security posture of secrets management," and help to avoid many bad password habits like weak passwords and re-using passwords.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.