Executive brief
AWS has a stored XSS vulnerability in a Participant URL field that allows attackers to inject malicious code. When users interact with the affected feature, the injected code executes in their browser and can steal session tokens, leading to complete account compromise and unauthorized access to AWS resources.
Technical details
This vulnerability is a stored cross-site scripting (XSS) flaw in the Participant URL field, where unsanitized user input is persisted and later reflected to users' browsers without proper encoding. An attacker can craft a malicious URL containing JavaScript payload and submit it via the Participant URL field; when other users view or interact with this field, the payload executes in their browser context. The attack requires an attacker to have access to submit or modify participant URLs, but no network-level authentication bypass is needed from the victim's perspective. Successful exploitation allows an attacker to steal session tokens or cookies, enabling account takeover and full access to the victim's AWS account and resources. AWS has issued a security bulletin (CVE-2026-18481) and patches are available through official AWS channels.
Affected products
- AWS AWS Management Console or AWS service with Participant URL feature
Timeline
- 2026-09-22: disclosed: CVE-2026-18481 published via AWS Security Bulletins