Reverse Tabnabbing
ID |
reverse_tabnabbing |
Severity |
high |
Kind |
Security Misconfiguration |
CWE |
1022 |
Description
At least one link on this page is vulnerable to Reverse tabnabbing as it uses a target attribute without using both of the "noopener" and "noreferrer" keywords in the "rel" attribute, which allows the target page to take control of this page.
Rationale
When a link uses target="_blank" without rel="noopener noreferrer", the opened page gains access to the originating page’s window object via window.opener. An attacker can exploit this by redirecting the original page to a phishing site that mimics the legitimate application while the user is distracted in the new tab. Users may unknowingly enter credentials on the fake page, believing they were logged out or the session expired.