Credential disclosure via plaintext extension logging

Sensitive-data exposure in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows local users to read plaintext credentials. The browser extension writes some used credential pairs, including usernames and passwords, into a text log beneath its Local Extension Settings directory without encrypting the password values. Any local user able to read that log can harvest stored credentials without knowing the vault master secret, although the exact event that causes plaintext logging is undisclosed.