A newly discovered bug in the open source password manager, if exploited, lets attackers retrieve a targets master password — and proof-of-concept code is available.