CVE-2026-3096

Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft

En bref

Sévérité: MEDIUM 4.7
EPSS: EPSS 0.29 % · centile 21 (2026-10-27)
État: PUBLISHED
Publiée: 2026-09-10
Mise à jour: 2026-09-11
Attribuée par: WSO2
Statut NVD: Deferred

Description

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	WSO2
CVSS 3.1	MEDIUM 4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Faiblesses (CWE)

Références européennes

ENISA EUVD · EUVD-2026-75731
GCVE · GCVE-0-2026-3096

Produits affectés

Produit	Versions
WSO2 · WSO2 API Control Plane	affected 4.5.0 < 4.5.0.54 ; affected 4.6.0 < 4.6.0.18
WSO2 · WSO2 API Manager	unknown 0 < 3.2.0 ; affected 3.2.0 < 3.2.0.468 ; affected 3.2.1 < 3.2.1.87 ; affected 4.1.0 < 4.1.0.252 ; affected 4.2.0 < 4.2.0.192 ; affected 4.3.0 < 4.3.0.103

Références

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5164/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD