CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
Unauthenticated attackers can forge JWT tokens to gain administrative access and manipulate all application data in AWS Ops Wheel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6911?
CVE-2026-6911 is a critical authentication bypass vulnerability in AWS Ops Wheel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the deployment's User Pool, via a crafted JWT sent to the API Gateway endpoint.
To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.
Weakness: CWE-347
Which versions are affected by CVE-2026-6911?
How do I fix CVE-2026-6911?
No fix has been published for CVE-2026-6911 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-6911 being exploited?
There is no known exploitation of CVE-2026-6911 in the wild and no public exploit code.