1password

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any 1password product.

RSS Feeds for 1password security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in 1password products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by 1password Sorted by Most Security Vulnerabilities since 2018

1password7 vulnerabilities

1password Command Line2 vulnerabilities

1password Command Line Interface2 vulnerabilities

1password Connect2 vulnerabilities

1password Scim Bridge2 vulnerabilities

1password In The Browser1 vulnerability

1password Scim1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in 1password. 1password did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	2	6.25
2023	0	0.00
2022	2	5.15
2021	4	6.13
2020	1	9.80
2019	0	0.00
2018	1	5.90

It may take a day or so for new 1password vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent 1password Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-42219	Aug 06, 2024	1Password 8 8.10.36 XPC IPC Validation Bypass for Local Exfiltration 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.	1password
CVE-2024-42218	Aug 06, 2024	1Password 8<8.10.38 macOS local exfiltration via sec. bypass 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.	1password
CVE-2022-32550	Jun 15, 2022	An issue was discovered in AgileBits 1Password An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.	1password In The Browser Connect Scim Bridge And others...
CVE-2022-29868	May 09, 2022	1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass 1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affected secrets include vault items and derived values used for signing in to 1Password.	1password
CVE-2021-41795	Sep 29, 2021	The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable component of this extension, a malicious web page could read a subset of 1Password vault items that would normally be fillable by the user on that web page. These items are usernames and passwords for vault items associated with its domain, usernames and passwords without a domain association, credit cards, and contact items. (1Password must be unlocked for these items to be accessible, but no further user interaction is required.)	1password
CVE-2020-18173	Jul 26, 2021	A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.	1password
CVE-2021-36758	Jul 16, 2021	1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.	Connect
CVE-2021-26905	Feb 08, 2021	1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key.	Scim Bridge
CVE-2020-10256	Oct 27, 2020	An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3 An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to perform brute-force calculations of encryption keys and thus succeed at decryption.	Command Line Scim Command Line Interface And others...
CVE-2018-13042	Oct 05, 2018	The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity or com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity from an external application (since they are exported), it is possible to crash the 1Password instance.	1password