Aws Ops Wheel
Monthly
Authenticated users with low privileges can escalate to deployment admin in AWS Ops Wheel (pre-PR #165) by manipulating the custom:deployment_admin attribute through crafted UpdateUserAttributes API calls to Cognito User Pool. This privilege escalation allows full control over Cognito user account management and deployment administration. Upstream fix available via GitHub PR #165; AWS security bulletin AMZN-2026-018 confirms patch availability. No active exploitation confirmed (not in CISA KEV), but CVSS 8.7 reflects critical impact across confidentiality, integrity, and availability.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.
Authenticated users with low privileges can escalate to deployment admin in AWS Ops Wheel (pre-PR #165) by manipulating the custom:deployment_admin attribute through crafted UpdateUserAttributes API calls to Cognito User Pool. This privilege escalation allows full control over Cognito user account management and deployment administration. Upstream fix available via GitHub PR #165; AWS security bulletin AMZN-2026-018 confirms patch availability. No active exploitation confirmed (not in CISA KEV), but CVSS 8.7 reflects critical impact across confidentiality, integrity, and availability.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.