Riskcovery

CVE-2026-47074

ex_aws_sns SigningCertURL not validated in verify_message/1

State
Published
Severity
8.7 High
Published
May 28, 2026
Updated
May 29, 2026
Reserved
May 18, 2026

Read the record on cve.org

Description

Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.

This vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines 'Elixir.ExAws.SNS':verify_message/1, 'Elixir.ExAws.SNS.PublicKeyCache':get/1.

'Elixir.ExAws.SNS':verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.

This issue affects ex_aws_sns: from 2.0.1 before 2.3.5.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
ex_aws_snsex-aws
  • 2.0.1 to before 2.3.5Affected
ex_aws_snsex-aws
  • a7ec21880943f4dac1d59bda557db0ffcd2b61fa to before 1853d280b152d10384a1e21a22cf22152a60be48Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.