Skip to content
fr Sign in
7.3 High

CVE-2026-18481 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an…

Description

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

Affected products and versions

Product Affected versions Fixed in
AWS Ops Wheel Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of AWS Ops Wheel

The 3 CVEs of AWS Ops Wheel →
CVE-2026-6912 Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in… 8.8 High CVE-2026-6911 Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain… 9.8 Critical
Track this CVE