PT-2026-60451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified AWS Cognito affected versions not specified Microsoft Entra ID affected versions not specified Description One issue exists in the Linux kernel where the ECSPI is incorrectly configured when a DMA...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: zitadel, kubescape-server-fips, longhorn-cli, crossplane-provider-aws-rds, packer-fips, etcd-fips, crossplane-provider-aws-ecr, chainloop-control-plane-fips, crossplane-provider-aws-elb-fips, crossplane-provider-aws-rolesanywhere-fips, longhorn-manager, frankenphp-8....

CVE-2026-49204 Hard-coded AWS Cognito Testing Accounts

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation...

CVE-2026-49204

Technical details about CVE-2026-49204 are not publicly available in the provided documents; monitor for updates.

CVE-2026-49204 Hard-coded AWS Cognito Testing Accounts

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation...

EUVD-2026-25577

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR 165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API...

Popeyes, Tim Hortons, Burger King platforms have “catastrophic” vulnerabilities, say hackers

Two ethical hackers say they have uncovered massive security vulnerabilities in the platforms hosted by Restaurant Brands International RBI. RBI is one of the world's largest quick service restaurant companies. It was formed in 2014 through a $12.5 billion merger of the American fast food chain...

VulnCheck KEV: CVE-2023-22893

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

CVE-2024-45037

The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called...

PT-2024-35171

Name of the Vulnerable Software and Affected Versions Amazon Cognito affected versions not specified Description The issue allows previously authenticated users to continue executing authorized API requests until their authentication token expires, even after logging out. This is because...

Unauthorized Access

aws-cdk is vulnerable to Unauthorized Access. The vulnerability is due to improper handling of authorization scopes when using the RestApi construct with CognitoUserPoolAuthorizer This flaw allows authenticated Amazon Cognito users to gain broader access than intended...

PT-2024-31387 · Amazon · Aws Cloud Development Kit

Name of the Vulnerable Software and Affected Versions: AWS Cloud Development Kit CDK versions 2.142.0 through 2.148.0 Description: The issue in AWS Cloud Development Kit CDK can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application...

Strapi 授权问题漏洞

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions prior to 4.5.5 that stems from the fact that Strapi does not validate access or ID tokens issued during the OAuth process when the AWS Cognito login provider is used for authentication...

PT-2023-33074 · Amazon · Aws Cognito

Name of the Vulnerable Software and Affected Versions: Strapi versions 4.5.6 and earlier Description: The issue concerns the verification of access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token...

PT-2023-18757

Name of the Vulnerable Software and Affected Versions Strapi versions 3.2.1 through 4.5.5 Description The issue arises from the lack of verification of access or ID tokens issued during the OAuth flow when using the AWS Cognito login provider for authentication. This allows a remote attacker to...

Amazon Cognito Insecure Permissions

Amazon Cognito is a cloud product from Amazon Web Services AWS which provides user authentication, authorization and management services for web and mobile applications. By using Amazon Cognito, developers can quickly add a user management feature to their applications, control and enforce...

Amazon Cognito User Enumeration

Amazon Cognito is a cloud product from Amazon Web Services AWS which provides user authentication, authorization and management services for web and mobile applications. By using Amazon Cognito, developers can quickly add a user management feature to their applications, control and enforce...

Amazon Cognito Detected

Amazon Cognito is a cloud product from Amazon Web Services AWS which provides user authentication, authorization and management services for web and mobile applications. By using Amazon Cognito, developers can quickly add a user management feature to their applications, control and enforce...