Security readout for executives and security teams
Plain-English summary
WEBCON BPS can run attacker-supplied JavaScript when an authenticated user opens a specially crafted link targeting the /openinmobileapp endpoint. This could expose or alter information available within the user’s browser session. The attack requires user interaction, and fixed releases are available.
Executive priority
Schedule near-term remediation because fixed releases are available and exploitation could affect authenticated business users. Accelerate deployment for internet-facing systems, privileged users, or sensitive workflows. The medium severity, interaction requirement, and lack of established active exploitation do not justify emergency treatment by themselves.
Technical view
This is reflected cross-site scripting (CWE-79) in a parameter processed by /openinmobileapp. It is remotely reachable, low complexity, and requires an authenticated victim to open the crafted URL. CVSS 4.0 rates it 5.1. WEBCON fixed the issue in 2026.1.3.109 and 2025.2.1.293.
Likely exposure
Exposure applies to organizations running the specifically identified WEBCON BPS builds 2026.1.1.45 or 2025.1.1.87. Successful exploitation requires access to the endpoint and an authenticated user opening an attacker-controlled link. Internet-facing deployments may offer attackers more opportunities to deliver such links.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not marked as included in KEV. Exploitation is nevertheless plausible because it is network-accessible, low complexity, and needs no attacker privileges. The required authenticated-user interaction limits reliability but does not eliminate phishing or targeted-link risk.
Researcher notes
The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N. The supplied affected list names only builds 2026.1.1.45 and 2025.1.1.87; it does not clearly establish the status of intervening builds. Confirm broader version exposure with WEBCON.
Mitigation direction
- Upgrade the 2026 branch to WEBCON BPS 2026.1.3.109 or a vendor-confirmed later fixed release.
- Upgrade the 2025 branch to WEBCON BPS 2025.2.1.293 or a vendor-confirmed later fixed release.
- If upgrading is delayed, consult WEBCON guidance; the supplied sources name no alternate technical mitigation.
- Warn authenticated users against opening unexpected links targeting the /openinmobileapp endpoint.
Validation and detection
- Inventory deployed WEBCON BPS versions and identify installations matching the affected builds.
- Confirm each upgraded installation reports the appropriate fixed build or a vendor-confirmed later fixed release.
- With authorization, verify endpoint parameters cannot execute script in an authenticated browser session.
- Review web and proxy logs for unusual /openinmobileapp requests; absence does not prove non-exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1630 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——CERT-PLVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.pl/en/posts/2026/05/CVE-2026-1630/CVE reference, CERT-PL · third-party-advisory
- https://community.webcon.com/download/changelog/398?q=db746ecCVE reference, CERT-PL · release-notes
- https://community.webcon.com/download/changelog/394?q=6a8b113CVE reference, CERT-PL · release-notes
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.