Security issue or 'feature': Browser extension auto login into management console

Hello @dragon1! 👋

Thanks for taking the time to share your concerns, I appreciate you looking closely at how this works. What you’re seeing is an intended feature, not a security vulnerability. The 1Password browser extension can sign you into 1Password.com because you’ve already authenticated and unlocked the extension. This reduces friction while maintaining the same underlying security guarantees.

A few clarifications:

• The extension must already be unlocked, which requires successful authentication (with both your account password and Secret Key) and unlock (with your account password, biometrics, etc.).
• Communication between the extension and 1Password.com uses secure, well-defined mechanisms.
• This is not remote code execution (RCE); no untrusted code is executed locally.
• The web session is derived from your already-authenticated extension session, it does not bypass authentication.

If someone can unlock your 1Password extension, they already have full access to your account. Automatically signing you into 1Password.com doesn’t grant any additional access; it simply reuses the existing authenticated session in that browser.

-Dave

Hope to get some more feedback here. 

Edit:
Especially for all those users who are using the travel mode - see closed topic here: 

Community | 1Password 

The travel mode is kind of useless as everyone looking at your travel mode also has full access to your account. 

@dragon1 

Please see my responses in this thread regarding Travel Mode and what it can (and can't) protect against: Travel Mode - Security Key (and saved within iOS/macOS iCloud Account?! | 1Password Community

I've closed this thread as a duplicate. 

-Dave