Live › vulnerability › CVE-2026-108049
The Alosuite web application's login interface can be embedded in an attacker's page because it lacks X-Frame-Options or a frame-ancestors policy. A victim tricked into clicking the malicious page can have unwanted actions performed inside the hidden Alosuite frame.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 13:20 UTC. All times on this page are UTC.
Organizations that run the Alosuite web application and let users sign in through its browser interface. The sources do not name affected versions or deployment modes. Teams that do not expose Alosuite to users in a browser are unlikely to be affected.
No product ranges from the sources yet.
X-Frame-Options or a Content-Security-Policy containing frame-ancestorsUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.
This page as .md · .json · in your agent: get_signal("CVE-2026-108049")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.