AWS Toolkit EUVD-2026-95128

Requires (1) a local account on the same host and (2) a victim who has authenticated the AWS Toolkit for VS Code's CodeCatalyst connection, producing a token cache file written with world-readable permissions by versions before 4.10.0. Exploitation is LIMITED to systems where multiple users share access - on a single-user developer workstation no second principal exists to abuse the permissions. No remote vector, no user interaction, and no elevated privileges are needed beyond an ordinary local login; the stolen token's usefulness is further bounded by its validity lifetime and the victim's CodeCatalyst permissions.

This is a genuine but lower-tier priority - a local information-disclosure flaw, not a remote-exploitable critical. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: exploitation requires an existing local account (PR:L) on a machine where a victim has authenticated the AWS Toolkit, and the only impact is confidentiality (VC:H) - the theft of CodeCatalyst bearer tokens - with no integrity or availability impact. The 6.8 'medium' score accurately reflects that the attacker must already have a foothold on the host. No EPSS score, CISA KEV entry, SSVC decision, or public POC was supplied in the input, which is unsurprising for a local file-permission issue reported by the vendor (AMZN) rather than observed in the wild. There is no conflict between the CVSS vector and the description - both point to local access. The practical risk is confined to multi-user hosts, shared/CI build machines, or any system an attacker can access locally; on a single-user developer workstation the exposure is minimal. Downstream impact can be meaningful: a stolen bearer token grants access to the victim's CodeCatalyst resources (source code, dev environments), so treat it as higher priority on shared infrastructure.

On a shared or multi-user host (e.g., a build server or jump box) where a developer has signed into the AWS Toolkit for VS Code, a second local user with an unprivileged account reads the world-readable token cache file and extracts the victim's CodeCatalyst bearer token. The attacker then replays that token to access the victim's CodeCatalyst projects and dev environments. No public exploit is required - the attack is a simple file read; no POC was identified in the input.