Critical AWS Ops Wheel Flaws Enable Admin Takeover via JWT Forgery and Cognito Abuse

AWS disclosed two severe vulnerabilities in AWS Ops Wheel that can let attackers seize administrative control of deployments and manipulate tenant data. CVE-2026-6911 is an authentication bypass caused by missing JWT signature verification at the API Gateway endpoint, allowing unauthenticated attackers to forge tokens and gain unintended admin access. AWS said successful exploitation could let attackers read, modify, and delete application data across tenants and manage Cognito user accounts in the deployment's User Pool; the flaw is tracked as CWE-347 and carries a critical CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H rating.

AWS also fixed CVE-2026-6912, a privilege-escalation issue in Ops Wheel's Cognito User Pool configuration that let authenticated users promote themselves to deployment administrator by setting the custom:deployment_admin attribute through the UpdateUserAttributes API. The bug, classified as CWE-915, exposed the same ability to manage Cognito user accounts and carried a high-severity CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score. AWS directed customers to redeploy from the updated repository and apply the fixes to any forked or derivative code, with patches referenced in an AWS security bulletin, a GitHub pull request, and a GitHub security advisory.