The vulnerability CVE-2026-47074 in the ex-aws ex_aws_sns library arises from improper certificate validation in the verify_message/1 function. Specifically, the function fails to validate that the SigningCertURL parameter uses HTTPS and is from an AWS-owned domain. This allows an attacker to supply a malicious SigningCertURL, bypassing SNS signature verification and enabling acceptance of forged SNS messages. The affected versions are from 2.0.1 up to but not including 2.3.5. A patch is available, and because this is a cloud service, remediation is typically managed by the vendor server-side. No active exploitation has been reported.

An attacker can bypass the SNS signature verification process by exploiting improper certificate validation, allowing forged SNS messages to be accepted as valid. This could lead to unauthorized actions or misinformation being processed by systems relying on SNS messages for trusted communication. However, no known exploits are currently reported in the wild.

A patch addressing this vulnerability is available. Since ex_aws_sns is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory to confirm that the patch has been applied. No additional action is required if the vendor has already mitigated the issue.