CVE-2026-1630 WEBCON CVE debrief

Who should care

Roles: IT administrators, security teams, and developers of WEBCON BPS systems. Deployment contexts: WEBCON BPS installations with the /openinmobileapp endpoint exposed, especially those with authenticated user interactions.

Why it matters

CVE-2026-1630 is a Reflected XSS vulnerability in WEBCON BPS that requires prompt attention from IT administrators, security teams, and developers. The vulnerability allows an attacker to execute arbitrary JavaScript in the browser of an authenticated user, potentially leading to security bypass or data exposure. Affected systems should be assessed and remediated with priority, using fixes in versions 2026.1.3.109 or 2025.2.1.293, or later. Evidence from official sources supports this defensive priority.

• Potential for arbitrary JavaScript execution in users' browsers
• Risk of security bypass or data exposure through user interactions
• Need for prompt assessment and remediation of vulnerable WEBCON BPS systems
• Possible impact on business operations through compromised user sessions

Technical summary

CVE-2026-1630 is a Reflected XSS vulnerability in WEBCON BPS via the /openinmobileapp endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. The issue was fixed in versions 2026.1.3.109 and 2025.2.1.293. The vulnerability allows for potential security bypass or data exposure through user interactions, emphasizing the need for prompt assessment and remediation of vulnerable WEBCON BPS systems. Confirmed affected product deployments should be prioritized for remediation, using fixes in versions 2026.1.3.109 or 2025.2.1.293, or later.

Defensive priority

Assess exposure, prioritize remediation for authenticated user interactions

Recommended defensive actions

• Assess exposure of WEBCON BPS installations to the /openinmobileapp endpoint
• Verify user interactions with the endpoint and prioritize remediation
• Apply fixes in versions 2026.1.3.109 or 2025.2.1.293, or later
• Monitor for suspicious user activity on WEBCON BPS systems
• Update incident response plans to address potential XSS attacks

Evidence notes

CVE-2026-1630 details a Reflected XSS vulnerability in WEBCON BPS via the /openinmobileapp endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. The issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.