Loading story…
Amazon Cognito multi-Region replication (MRR) now lets organizations replicate a primary user pool to one replica AWS Region for near-real-time user synchronization and authentication failover. The primary pool remains authoritative, while replicas support authentication, token issuance and revocation, and selected read-only operations; configuration and user-attribute writes are not available in the replica. Sessions and JWTs are interoperable between Regions, and deployments require a symmetric multi-Region customer-managed AWS KMS key.
AWS recommends using Cognito’s multi-Region OIDC issuer so OIDC discovery and JWKS endpoints remain reachable during a regional impairment, with Route 53 health checks used to automate domain failover. Organizations should deploy equivalent regional dependencies—including Lambda triggers, AWS WAF, SNS, SES, and monitoring—and validate failover through health-check inversion and AWS Fault Injection Service. Security teams must also account for independent replica quotas, data-residency requirements, and the lack of TOTP MFA support in replica pools while preserving OpenID Connect controls such as TLS, signed JWT validation, nonce protection, and exact redirect-URI validation.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
AWS described Amazon Cognito multi-Region replication, which synchronizes a primary user pool with one replica Region for authentication failover while retaining the primary pool as authoritative for configuration and user-attribute writes. The guidance covers multi-Region KMS keys, interoperable sessions and JWTs, multi-Region OIDC issuers, Route 53-driven failover, and replica limitations including unsupported TOTP MFA.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourceopenid.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers warned that common **Amazon Cognito User Pools** configurations can let authenticated users directly modify their own profile data in ways that undermine application security. The report highlights that Cognito access tokens often include the default scope `aws.cognito.signin.user.admin`, and when developers also allow broad attribute read/write permissions, users can call the `UpdateUserAttributes` API to change values such as custom privilege flags or other application-relevant fields stored in Cognito. The findings also describe broader design pitfalls that can expose Cognito directly to attackers, including selecting SPA or mobile app client types that reveal enough information for direct authentication attempts, leaving self-sign-up enabled unintentionally, permitting alternate auth flows that bypass server-side controls, and relying on Cognito attributes for authorization decisions. Researchers said organizations should minimize readable and writable attributes, avoid storing sensitive authorization state in user attributes, disable unnecessary authentication flows, prefer traditional web application clients when direct client-side Cognito access is not required, and review logout, token revocation, and lockout behavior carefully.
Aug 15, 2026
AWS disclosed two severe vulnerabilities in **AWS Ops Wheel** that can let attackers seize administrative control of deployments and manipulate tenant data. **`CVE-2026-6911`** is an authentication bypass caused by missing JWT signature verification at the API Gateway endpoint, allowing unauthenticated attackers to forge tokens and gain unintended admin access. AWS said successful exploitation could let attackers read, modify, and delete application data across tenants and manage Cognito user accounts in the deployment's User Pool; the flaw is tracked as **`CWE-347`** and carries a critical **CVSS v3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`** rating. AWS also fixed **`CVE-2026-6912`**, a privilege-escalation issue in Ops Wheel's Cognito User Pool configuration that let authenticated users promote themselves to deployment administrator by setting the **`custom:deployment_admin`** attribute through the `UpdateUserAttributes` API. The bug, classified as **`CWE-915`**, exposed the same ability to manage Cognito user accounts and carried a high-severity **CVSS v3.1 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`** score. AWS directed customers to redeploy from the updated repository and apply the fixes to any forked or derivative code, with patches referenced in an AWS security bulletin, a GitHub pull request, and a GitHub security advisory.
Jun 29, 2026