Loading story…
Security researchers warned that common Amazon Cognito User Pools configurations can let authenticated users directly modify their own profile data in ways that undermine application security. The report highlights that Cognito access tokens often include the default scope aws.cognito.signin.user.admin, and when developers also allow broad attribute read/write permissions, users can call the UpdateUserAttributes API to change values such as custom privilege flags or other application-relevant fields stored in Cognito.
The findings also describe broader design pitfalls that can expose Cognito directly to attackers, including selecting SPA or mobile app client types that reveal enough information for direct authentication attempts, leaving self-sign-up enabled unintentionally, permitting alternate auth flows that bypass server-side controls, and relying on Cognito attributes for authorization decisions. Researchers said organizations should minimize readable and writable attributes, avoid storing sensitive authorization state in user attributes, disable unnecessary authentication flows, prefer traditional web application clients when direct client-side Cognito access is not required, and review logout, token revocation, and lockout behavior carefully.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A technical blog post analyzes ten security pitfalls and misconfigurations in AWS Cognito User Pools, including writable attributes, exposed tokens, self-sign-up, weak auth-flow combinations, and logout limitations. It recommends minimizing attribute permissions, avoiding sensitive authorization state in Cognito attributes, disabling unnecessary auth flows, and preferring traditional web application clients when direct client-side Cognito access is not intended.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS disclosed two severe vulnerabilities in **AWS Ops Wheel** that can let attackers seize administrative control of deployments and manipulate tenant data. **`CVE-2026-6911`** is an authentication bypass caused by missing JWT signature verification at the API Gateway endpoint, allowing unauthenticated attackers to forge tokens and gain unintended admin access. AWS said successful exploitation could let attackers read, modify, and delete application data across tenants and manage Cognito user accounts in the deployment's User Pool; the flaw is tracked as **`CWE-347`** and carries a critical **CVSS v3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`** rating. AWS also fixed **`CVE-2026-6912`**, a privilege-escalation issue in Ops Wheel's Cognito User Pool configuration that let authenticated users promote themselves to deployment administrator by setting the **`custom:deployment_admin`** attribute through the `UpdateUserAttributes` API. The bug, classified as **`CWE-915`**, exposed the same ability to manage Cognito user accounts and carried a high-severity **CVSS v3.1 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`** score. AWS directed customers to redeploy from the updated repository and apply the fixes to any forked or derivative code, with patches referenced in an AWS security bulletin, a GitHub pull request, and a GitHub security advisory.
Jun 29, 2026
AWS disclosed two critical vulnerabilities in **AWS Ops Wheel v2** that could let attackers seize full administrative control of customer deployments. **CVE-2026-6911** stems from missing cryptographic verification of JWT signatures in the v2 API, allowing an unauthenticated attacker with network access to the API Gateway endpoint to forge tokens with arbitrary tenant and administrator claims. The flaw could expose all application data across tenants and permit management of Amazon Cognito user accounts; it affects deployments built from **PR #147 through PR #163**, while v1 is not affected. GitHub advisory **`GHSA-v5vr-8w3c-37x2`** says the issue was fixed in **PR #164**, and temporary mitigations include restricting API Gateway access with **AWS WAF** or **VPC** controls. A second issue, **CVE-2026-6912**, allowed any authenticated user to escalate privileges by modifying self-writable security-sensitive Cognito attributes such as `custom:deployment_admin` through the Cognito `UpdateUserAttributes` API. An attacker could promote their own account to deployment administrator, then read, modify, or delete cross-tenant data and manage all users in the deployment’s Cognito User Pool. That flaw affects the same **PR #147-#163** range and was fixed in **PR #165** by tightening Cognito `WriteAttributes` and adding server-side email verification tied to `DEPLOYMENT_ADMIN_EMAILS`. Because Ops Wheel is deployed into customer AWS accounts through CloudFormation, each affected deployment and any forks or derivative code must be individually updated.
Jun 29, 2026
Datadog Security Labs disclosed **CVE-2024-28056**, an AWS Amplify flaw that left Cognito-linked IAM roles vulnerable to takeover when trust policies omitted the required Cognito identity pool audience restriction. The issue affected two Amplify variants: older CLI-created projects with insecure default trust policies and projects where the authentication component was later removed, leaving overly permissive roles behind. Researchers identified more than **8,000** public IAM role ARNs with recognizable Amplify naming patterns such as `authRole` and `unauthRole`, and showed that attackers could use Cognito Basic authflow together with STS to obtain short-lived credentials through ```text AssumeRoleWithWebIdentity ``` without additional authorization.
Jun 29, 2026