Academic study finds 25 attack methods in major cloud password managers exposing vault, recovery, and encryption design risks.