Loading vulnerability…
JWT Signature Verification Bypass in AWS Ops Wheel v2
CVE-2026-6911 is an authentication bypass vulnerability in the AWS Ops Wheel v2 API. The decode_jwt_payload_only() and validate_token_basic() functions decode JWT payloads without verifying their cryptographic signatures against the Amazon Cognito User Pool signing key. An unauthenticated attacker can submit a forged JWT containing attacker-controlled administrative and tenant claims to the API Gateway endpoint and obtain application administrator privileges. Affected deployments contain v2 code from pull requests 147 through 163; pull request 164 introduces RS256 signature verification. AWS Ops Wheel v1 is unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the affected deployment. Attackers can read, modify, and delete application data across all tenants and manage Cognito user accounts within the deployment's User Pool. Account manipulation can enable persistent access or deny access to legitimate users. The vulnerability has a CVSS v3.1 score of 9.8.
If you can’t patch tonight, do this now.
Until the corrected deployment is available, restrict access to the affected API Gateway endpoint to trusted callers or temporarily disable access to the vulnerable API. These containment measures reduce exposure but do not correct the missing JWT signature verification.
Patch, then assume compromise.
Redeploy each affected installation from the updated AWS Ops Wheel repository incorporating pull request 164 or later, which adds RS256 JWT signature verification. Apply equivalent fixes to forked or derivative codebases containing the vulnerable v2 API. Customer-hosted deployments must be updated individually. Also incorporate pull request 165 to address the separate Cognito attribute privilege-escalation vulnerability, CVE-2026-6912, and eliminate both identified administrative escalation paths.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.