Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
Published Jul 31, 2026
6.2
MEDIUMCVSS 4.0
EPSS 0.51%
Description
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme.
To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.
Affected products
-
Affected
- ≥ 0, ≤ PR168
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| AWS | AWS Ops Wheel | unaffected | Affected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (4)
- https://aws.amazon.com/security/security-bulletins/2026-068-aws/ vendor-advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51594 Advisory
- https://github.com/aws/aws-ops-wheel/pull/168 patch
- https://github.com/aws/aws-ops-wheel/security/advisories/GHSA-6rr8-cf9x-pj23 third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-068-aws/ | vendor-advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51594 | Advisory | |
| https://github.com/aws/aws-ops-wheel/pull/168 | patch | |
| https://github.com/aws/aws-ops-wheel/security/advisories/GHSA-6rr8-cf9x-pj23 | third-party-advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data