CVE-2026-3096

Received Received - Intake

Cross-Site Scripting (XSS) in Web Portal Configuration

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: WSO2 LLC

Description

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-3096

Affected Vendors & Products

Vendor	Product	Version / Range
wso2	api_control_plane	4.6.0
wso2	api_control_plane	4.5.0
wso2	api_manager	From 3.2.0 (inc) to 4.6.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-603	A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves web portals that open external links in new browser tabs while keeping access to the original window. An attacker can exploit this to manipulate the trusted application window after a user clicks a malicious link, potentially redirecting them to phishing pages or enabling unauthorized actions.

Detection Guidance

This vulnerability involves browser window interaction after external link clicks. Detection requires manual testing of web portals by checking if the original window retains access after opening external links in new tabs. No specific commands are provided in the context.

Impact Analysis

Users could be tricked into entering credentials on fake pages, have their sessions hijacked, or unknowingly perform actions on trusted sites due to the interaction between the original and new browser contexts.

Compliance Impact

This vulnerability could lead to phishing attacks and credential theft, which may result in unauthorized access to sensitive data. This could violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Disable the ability for the originating window to retain access to newly opened external pages in web portals. Implement sandboxing or noopener attributes for external links. Review and restrict cross-origin interactions between tabs.

Hi! I’m here to help you understand CVE-2026-3096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70