Stored cross‑site scripting exists in the participant URL handling of AWS Ops Wheel before the fix in pull request #168. The flaw allows an attacker to embed a malicious URI scheme in the participant_url field, which is stored and later rendered in a user’s browser. When an authenticated user opens a page containing the malicious entry, the browser evaluates the URI scheme and can expose the victim’s session token, thereby enabling the attacker to acquire full administrative control of the deployed instance. The underlying weakness is a classic input validation flaw classified as CWE‑79.

The vulnerability affects AWS Ops Wheel installations that have not been updated to include the changes from PR #168. All versions released before the latest update are potentially compromised. Users relying on earlier releases should verify the version they are operating and consider re‑deploying the latest available package from the vendor.

The CVSS score of 6.2 indicates moderate severity. The EPSS score of less than 1% reflects a low current likelihood of exploitation, though the vulnerability is listed as not being part of the CISA KEV catalog. Attackers must possess legitimate credentials to submit a crafted participant_url entry and rely on an authenticated session to receive the stolen token. Once the session token is captured, the attacker can perform privileged operations equivalent to an administrator.