Loading story…
Datadog Security Labs disclosed CVE-2024-28056, an AWS Amplify flaw that left Cognito-linked IAM roles vulnerable to takeover when trust policies omitted the required Cognito identity pool audience restriction. The issue affected two Amplify variants: older CLI-created projects with insecure default trust policies and projects where the authentication component was later removed, leaving overly permissive roles behind. Researchers identified more than 8,000 public IAM role ARNs with recognizable Amplify naming patterns such as authRole and unauthRole, and showed that attackers could use Cognito Basic authflow together with STS to obtain short-lived credentials through
AssumeRoleWithWebIdentity
without additional authorization.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
On 2024-11-21, Hacking the Cloud published a write-up showing that same-account exploitation may still be possible for legacy vulnerable roles if the victim account has a Cognito identity pool with Basic authflow enabled. The article described both unauthenticated and authenticated attack paths and recommended deleting or correcting vulnerable roles rather than relying only on AWS mitigations.
On 2024-04-15, Datadog published details of the two AWS Amplify vulnerability variants, describing how attackers could use Cognito Basic authflow and STS to obtain temporary credentials for vulnerable roles. The company said it had found more than 8,000 public IAM role ARNs during internet-scale testing and had notified affected customers.
In April 2024, AWS updated STS to prevent cross-account assumption of affected roles via AssumeRoleWithWebIdentity. Datadog noted this blocked cross-account abuse, though same-account exploitation could still remain for legacy roles under certain conditions.
In February 2024, AWS hardened IAM so customers could no longer create the affected malformed trust policies lacking the required Cognito audience restriction. This mitigation reduced future exposure from newly created roles.
In January 2024, AWS fixed Amplify CLI and Amplify Studio issues that created or preserved vulnerable IAM trust policies. These changes addressed the application-layer causes of both disclosed variants.
In January 2024, Datadog Security Research identified two AWS Amplify vulnerability variants that could let attackers assume vulnerable Cognito-associated IAM roles using AssumeRoleWithWebIdentity. The flaws stemmed from missing Cognito identity pool audience restrictions in trust policies.
Between August 2019 and January 2024, Amplify CLI and Amplify Studio could leave behind IAM roles with improperly restricted trust policies when the authentication component was removed from a project. Datadog later identified this as the first vulnerability variant.
From July 2018 to August 2019, AWS Amplify CLI created projects with IAM role trust policies that lacked the required Cognito identity pool audience restriction. This later became Datadog's second vulnerability variant affecting Cognito-associated roles.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
hackingthe.cloud
Open sourcesecuritylabs.datadoghq.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS disclosed two severe vulnerabilities in **AWS Ops Wheel** that can let attackers seize administrative control of deployments and manipulate tenant data. **`CVE-2026-6911`** is an authentication bypass caused by missing JWT signature verification at the API Gateway endpoint, allowing unauthenticated attackers to forge tokens and gain unintended admin access. AWS said successful exploitation could let attackers read, modify, and delete application data across tenants and manage Cognito user accounts in the deployment's User Pool; the flaw is tracked as **`CWE-347`** and carries a critical **CVSS v3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`** rating. AWS also fixed **`CVE-2026-6912`**, a privilege-escalation issue in Ops Wheel's Cognito User Pool configuration that let authenticated users promote themselves to deployment administrator by setting the **`custom:deployment_admin`** attribute through the `UpdateUserAttributes` API. The bug, classified as **`CWE-915`**, exposed the same ability to manage Cognito user accounts and carried a high-severity **CVSS v3.1 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`** score. AWS directed customers to redeploy from the updated repository and apply the fixes to any forked or derivative code, with patches referenced in an AWS security bulletin, a GitHub pull request, and a GitHub security advisory.
Jun 29, 2026
AWS disclosed two critical vulnerabilities in **AWS Ops Wheel v2** that could let attackers seize full administrative control of customer deployments. **CVE-2026-6911** stems from missing cryptographic verification of JWT signatures in the v2 API, allowing an unauthenticated attacker with network access to the API Gateway endpoint to forge tokens with arbitrary tenant and administrator claims. The flaw could expose all application data across tenants and permit management of Amazon Cognito user accounts; it affects deployments built from **PR #147 through PR #163**, while v1 is not affected. GitHub advisory **`GHSA-v5vr-8w3c-37x2`** says the issue was fixed in **PR #164**, and temporary mitigations include restricting API Gateway access with **AWS WAF** or **VPC** controls. A second issue, **CVE-2026-6912**, allowed any authenticated user to escalate privileges by modifying self-writable security-sensitive Cognito attributes such as `custom:deployment_admin` through the Cognito `UpdateUserAttributes` API. An attacker could promote their own account to deployment administrator, then read, modify, or delete cross-tenant data and manage all users in the deployment’s Cognito User Pool. That flaw affects the same **PR #147-#163** range and was fixed in **PR #165** by tightening Cognito `WriteAttributes` and adding server-side email verification tied to `DEPLOYMENT_ADMIN_EMAILS`. Because Ops Wheel is deployed into customer AWS accounts through CloudFormation, each affected deployment and any forks or derivative code must be individually updated.
Jun 29, 2026Researchers and cloud security vendors documented a recurring AWS IAM trust policy flaw in OIDC integrations for **Terraform Cloud** and **GitHub Actions** that can let unauthorized external workloads assume customer roles. In both cases, the issue stems from missing or overly broad `sub` conditions in resource-based trust policies: older AWS-created Terraform Cloud policies could omit `app.terraform.io:sub`, and GitHub Actions deployments often lacked the repository-specific `sub` restriction. That weakness meant any valid identity token from the trusted OIDC provider could potentially satisfy the role trust and gain access to the victim AWS account. Public writeups showed how attackers could exploit broad Terraform Cloud patterns by creating a matching organization, project, and workspace, then using Terraform to provision a backdoored IAM role with **`AdministratorAccess`**. The GitHub Actions variant was amplified by copied example code and Terraform JSON duplicate-key behavior, prompting coordinated disclosures by researchers, Wiz, Datadog, AWS, and HashiCorp. AWS updated its console behavior, notified affected customers, blocked creation of some new misconfigured policies, and set enforcement deadlines, while defenders were urged to audit OIDC trust relationships, require precise subject claims, and use controls such as **Resource Control Policies** and detection rules to prevent arbitrary role assumption.
Sep 3, 2026