CVE-2026-6911 | Missing JWT signature verification in AWS Ops Wheel allows u… | CVSS 9.8 CRITICAL

Description

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the deployment's User Pool, via a crafted JWT sent to the API Gateway endpoint. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

Metadata

CVE ID: CVE-2026-6911
State: PUBLISHED
Assigner: AMZN
Reserved: 2026-04-23 13:38 UTC
Published: 2026-04-24 16:08 UTC
Last updated: 2026-04-30 15:21 UTC
Primary CWE: CWE-347
CWE-347 Improper verification of cryptographic signature
Vendor / Product: AWS / AWS Ops Wheel
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
AWS	AWS Ops Wheel	—	0 < 163

Weakness (CWE)

CWE	Source	Description
CWE-347	cna	CWE-347 Improper verification of cryptographic signature

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References (3)