CVE-2026-18481

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

CVE-2026-18481

CVE-2026-18481 describes a stored cross-site scripting flaw in the AWS Ops Wheel project, affecting the participant_url handling. The issue, triggered by a crafted participant_url value with a dangerous URI scheme, could allow an authenticated remote user to steal session tokens and escalate to f...

EUVD-2026-51594

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...