EUVD-2026-51594Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable app, low-privilege auth required, scope changes to victim browser with high confidentiality (session token) and integrity (admin takeover) impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
3DescriptionCVE.org
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme.
To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.
AnalysisAI
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the participant_url field is rendered back into the page without adequate sanitization of URI schemes, permitting javascript: or data: URI payloads to be stored and later executed. AWS Ops Wheel (CPE: cpe:2.3:a:aws:aws_ops_wheel:*:*:*:*:*:*:*:*) is an open-source Amazon-maintained web application for managing on-call rotations and team spin-wheels. The CVSS 4.0 vector explicitly models this as a scope-affecting flaw - vulnerable system impact is nil (VC:N/VI:N/VA:N) but subsequent system impact is high (SC:H/SI:H), reflecting that the exploit targets the victim's browser session rather than the server directly. The attack requires low privileges (PR:L) and active user interaction from a victim (UI:A), consistent with a stored XSS that only fires when viewed.
RemediationAI
Upstream fix available via PR #168; no independently confirmed tagged release version was provided in the advisory data. Organizations should redeploy AWS Ops Wheel from the latest source on the main branch, which incorporates the fix for participant_url sanitization, per the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-068-aws/. As a compensating control prior to redeployment, administrators should restrict write access to participant entries to the most trusted users only, reducing the attacker's ability to plant a payload. Additionally, Content Security Policy (CSP) headers can be evaluated for deployment to block inline script execution and dangerous URI schemes, though this requires application-level configuration and may not be available in all deployment configurations of this tool. Monitoring audit logs for unexpected participant_url values containing 'javascript:' or 'data:' substrings can serve as a detection measure.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today