Password-manager audit found 25 distinct attack methods

What happened

Researchers systematically audited Bitwarden, LastPass, Dashlane and 1Password. They identified 25 ways that design choices and cryptographic misunderstandings could weaken stored or shared credentials.

No evidence of real-world exploitation was found; this was an academic audit of systemic design risk.

What was found

The findings included key-escrow weaknesses, field-swap attacks and backward-compatibility downgrade paths. Several vendors patched issues, while some findings were treated as intentional design decisions.

Data at risk

• Saved passwords
• Shared entries
• Encryption keys
• Account recovery
• Enterprise vaults
• Authentication data

What you should do

1. 1Update the password manager to its latest version.
2. 2Be cautious when sharing vault entries.
3. 3Enable two-factor authentication for the manager account.
4. 4Do not assume a well-known product is free of design flaws.