Threats affecting pkg:github/aws/aws-ops-wheel

CVE-2026-6912 is a high-severity vulnerability in AWS Ops Wheel affecting the Cognito User Pool configuration. It allows remote authenticated users to escalate privileges to deployment admin by exploiting improper control over dynamically-determined object attributes via a crafted UpdateUserAttributes API call. This enables attackers to set the custom:deployment_admin attribute and manage Cognito user accounts. The vulnerability is present before pull request #165 and affects version 0 of AWS Ops Wheel. AWS manages remediation for this cloud service and has released a fix. Users should redeploy from the updated repository and patch any forked or derivative code accordingly.

CVE-2026-6911 is a critical vulnerability in AWS Ops Wheel caused by missing verification of JWT signatures. This flaw allows unauthenticated attackers to forge JWT tokens and gain administrative access, including reading, modifying, and deleting all application data across tenants and managing Cognito user accounts. The issue affects AWS Ops Wheel versions 0 up to but not including 163, including version 0. AWS has released a patch to remediate this vulnerability. Users should redeploy from the updated repository and patch any forked or derivative code accordingly.