This vulnerability involves improper neutralization of input during web page generation (CWE-79) in AWS Ops Wheel's participant URL handling. The flaw allows stored XSS via a crafted participant_url value, which can be exploited by an authenticated user to steal session tokens and escalate privileges to administrative control. The issue affects versions prior to the fix introduced in pull request #168. AWS, as the cloud service provider, manages remediation by updating the deployed instances through redeployment with the latest aws-ops-wheel version.

Successful exploitation can lead to theft of session tokens and privilege escalation to full administrative control of the affected AWS Ops Wheel instance. This compromises confidentiality and integrity of the service without impacting availability. The CVSS v3.1 score is 7.3 (High), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity.

AWS manages remediation for this cloud-hosted service. Users should redeploy their AWS Ops Wheel instances using the latest version that includes the fix from pull request #168. Check the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-068-aws/ for current remediation guidance and confirmation of patch status.