Vulnerability · Published Sep 10, 2026 · Assigned by WSO2
CVE-2026-3096Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
Medium 4.7
In plain English
A medium-severity improper input validation in WSO2 API Control Plane from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0 – before 4.5.0.544.6.0 – before 4.6.0.18 |
| WSO2 | WSO2 API Manager | 3.2.0 – before 3.2.0.4683.2.1 – before 3.2.1.874.1.0 – before 4.1.0.2524.2.0 – before 4.2.0.1924.3.0 – before 4.3.0.1034.4.0 – before 4.4.0.674.5.0 – before 4.5.0.52 |
Weakness: CWE-20, CWE-603 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N