The vulnerability resides in the Alosuite login interface, which can be invisibly loaded within an attacker‑controlled web page because the application does not use the X-Frame-Options header nor a Content‑Security‑Policy with the frame‑ancestors directive. This allows a malicious page to trick a user into interacting with the embedded interface, resulting in the execution of unintended actions inside Alosuite. The impact is the potential compromise of user interactions, which could enable further exploitation against authenticated users.

AM System ALO Suite version 25_09_15.03_35 is affected. The vendor has released version 26_04_15.03_10 in April 2026 that contains the fix.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a user clicking on or interacting with a malicious web page that embeds the vulnerable login page; exploitation requires only that the user visits the page and performs an action within the hidden frame.