CVE-2026-6911

Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

State: Published
Severity: 9.3 Critical
Published: Apr 24, 2026
Updated: Apr 30, 2026
Reserved: Apr 23, 2026

Description

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the deployment's User Pool, via a crafted JWT sent to the API Gateway endpoint.

To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L	AMZN
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	AMZN

Weaknesses

CWE-347 Improper verification of cryptographic signature

Affected Products

Product	Versions
AWS Ops WheelAWS	before 163Affected

References

https://aws.amazon.com/security/security-bulletins/2026-018-aws/vendor-advisory
https://github.com/aws/aws-ops-wheel/pull/164patch
https://github.com/aws/aws-ops-wheel/security/advisories/GHSA-v5vr-8w3c-37x2third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.