Skip to content
OpenAdvisories

Product · AWS

AWS Ops Wheel

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.3
    CVE-2026-18481

    Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

    Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url val…

    AWS AWS Ops Wheel
  • High 8.8
    CVE-2026-6912

    Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel

    Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts…

    AWS AWS Ops Wheel