Popular password manager could have a critical vulnerability