Executive brief
WSO2 API Manager and API Control Plane web portals allow external links to open in new browser tabs while retaining access from the newly-opened page back to the original window. An attacker can exploit this to redirect users to phishing pages or steal credentials after a user clicks a malicious external link, compromising the security of the trusted application.
Technical details
The vulnerability is a reverse tabnabbing attack in the product's web portal link-handling functionality. When external links are opened in new tabs, the originating window object remains accessible to the newly-opened page via the window.opener property (or similar mechanisms), allowing the attacker-controlled page to manipulate or redirect the original trusted application window. The attack requires user interaction (clicking a malicious link) and affects the web portal UI layer. Patches are available via GitHub and through WSO2 support subscription updates at specified update levels for affected versions.
Affected products
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
Timeline
- 2026-07-04: disclosed
- 2026-09-10: advisory