PT-2026-66834

CVE-2026-18481

·

Published

2026-07-31

·

Updated

2026-08-04

Description by

CVSS 3.1
7.3
High
MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions AWS Ops Wheel versions prior to PR #168
Description Stored cross-site scripting occurs during the handling of participant URLs. An authenticated remote user can exploit this by providing a crafted participant url value containing a dangerous URI scheme, which may lead to the theft of session tokens and subsequent escalation to full administrative control of the deployed instance.
Recommendations Redeploy from the latest version of aws-ops-wheel.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-18481
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com