---
id: "CVE-2026-108049"
kind: "vulnerability"
aliases: ["CVE-2026-108049"]
title: "Alosuite login page can be framed for clickjacking attacks"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["alosuite", "other", "web-app"]
not_affected_if: ["headers-already-set", "no-browser-access"]
published_at: "2026-11-03T13:17:17+00:00"
first_seen_at: "2026-11-03T13:20:52+00:00"
updated_at: "2026-11-03T13:21:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108049", "first_seen_at": "2026-11-03T13:20:52+00:00"}]
---

# Alosuite login page can be framed for clickjacking attacks

The Alosuite web application's login interface can be embedded in an attacker's page because it lacks X-Frame-Options or a frame-ancestors policy. A victim tricked into clicking the malicious page can have unwanted actions performed inside the hidden Alosuite frame.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Request the Alosuite login page and check the response headers for `X-Frame-Options` or a `Content-Security-Policy` containing `frame-ancestors`
- Confirm which Alosuite version is deployed; the sources do not name affected versions

## Timeline

- 2026-11-03T13:20:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108049

## From the sources

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_