Security Advisory WSO2-2026-5164/CVE-2026-3096¶

Published: July 04, 2026

Updated: July 04, 2026

Version: 1.0

Severity: Medium

CVSS Score: 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)

CVE IDs: CVE-2026-3096

AFFECTED PRODUCTS¶

• WSO2 API Control Plane: 4.6.0, 4.5.0
• WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 3.2.1, 3.2.0

OVERVIEW¶

Potential Reverse Tabnabbing.

DESCRIPTION¶

The product's web portals include functionality to open external links in a new browser tab. In certain instances, the originating window remains accessible to the newly opened page, allowing for potential interaction between the two browser contexts when navigating to external destinations.

IMPACT¶

This vulnerability could allow an attacker to manipulate the original application window after a user clicks a malicious external link, potentially redirecting users to phishing pages, stealing credentials, or performing other unauthorized actions in the context of the trusted site.

SOLUTION¶

Community Users (Open Source)¶

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2/apim-apps/pull/1262

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level or a higher update level to apply the fix.