CVE-2026-18481 - Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft Bulletin ID: 2026-068-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/31/2026 11:00 AM PDT Description: AWS Ops Wheel is an open-source operational decision-making tool published under the AWS GitHub organization and self-deployed by customers into their own AWS accounts via CloudFormation. The application did not sufficiently validate the participant URL field — server-side validation checked only the value's length, not whether it was a safe web URL (CWE-79) — so a user with participant-management permission (a Wheel Admin/Admin) could store a crafted URL that could execute script in another user's authenticated browser session (stored cross-site…