Unrated severityNVD Advisory· Published Jul 31, 2026· Updated Jul 31, 2026
Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
CVE-2026-18481
Description
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme.
To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: < PR #168
Patches
Vulnerability mechanics
References
3- github.com/aws/aws-ops-wheel/pull/168mitrepatch
- aws.amazon.com/security/security-bulletins/2026-068-aws/mitrevendor-advisory
- github.com/aws/aws-ops-wheel/security/advisories/GHSA-6rr8-cf9x-pj23mitrethird-party-advisory
News mentions
0No linked articles in our index yet.