Introduction
A misconfigured Amazon Cognito User Pool Client in AWS Ops Wheel v2 lets any authenticated user grant themselves full deployment admin privileges with a single API call. That gives the user complete administrative control over the application. They can read, modify, and delete all data across tenants and manage every Cognito user account in the deployment.
AWS Ops Wheel is an open-source tool that helps teams make random selections with a virtual spinning wheel. Development and operations teams use it for lightweight decision making, and it is deployed into customer AWS accounts via CloudFormation. Because the infrastructure lives entirely in customer accounts, AWS cannot push a central fix. Each deployment must be updated individually.
Technical Information
Root Cause: Unrestricted Cognito WriteAttributes
CVE-2026-6912 falls under CWE-915: Improperly Controlled Modification of Dynamically Determined Object Attributes. In affected AWS Ops Wheel v2 deployments, the Cognito UserPoolClient was configured without WriteAttributes restrictions, so the client placed no limits on which custom attributes an authenticated user could modify on their own profile.
The custom attributes in the User Pool included custom:deployment_admin and custom:wheel_group_id. The application's authorization logic uses these attributes to determine a user's privilege level. Because the UserPoolClient did not restrict client-side writes, any authenticated user could set them freely.
Attack Flow
The exploitation path is straightforward:
- An attacker authenticates to the AWS Ops Wheel v2 application with any valid account in the Cognito User Pool.
- The attacker sends a crafted
UpdateUserAttributesAPI call directly to the Cognito service and sets thecustom:deployment_adminattribute on their own user profile. - On later requests, the application's authorization logic reads the now-modified attribute and treats the attacker as a deployment admin.
- With admin privileges, the attacker can read, modify, and delete all application data across tenants, and can manage Cognito user accounts within the deployment User Pool.
The CVSS v3.1 score of 8.8 reflects the attack's characteristics: a network-based vector, low attack complexity, low privileges required (any authenticated user), no user interaction, and high impact on confidentiality, integrity, and availability.
How PR 165 Addresses the Flaw
The fix in PR 165 adds several layers of defense:
- The Cognito UserPoolClient now has a
WriteAttributesrestriction that explicitly blocks client-side writes tocustom:deployment_adminandcustom:wheel_group_id. Authenticated users can no longer modify these security-sensitive attributes through theUpdateUserAttributesAPI. - As defense in depth, the authorizer, the middleware, and the deployment admin operations now verify the user's email server side against
DEPLOYMENT_ADMIN_EMAILS. Even if someone bypassed the attribute restriction, the server-side check would reject unauthorized admin requests. - Admin API calls made by deploy scripts and Lambda functions bypass the
WriteAttributesrestriction and continue to work normally, so the patch does not break legitimate administrative workflows.
Companion Vulnerability: CVE-2026-6911
AWS addressed a second vulnerability in the same security bulletin. CVE-2026-6911 is missing JWT signature verification in the v2 API, which allows unauthenticated administrative access. PR 164 resolves it. Together, the two vulnerabilities amount to a comprehensive failure of the v2 authentication and authorization stack, and both patches must be applied to close every known escalation path.
| Vulnerability ID | Component | Root Cause | Patch | Impact |
|---|---|---|---|---|
| CVE-2026-6911 | v2 API | Missing JWT signature verification | PR 164 | Unauthenticated administrative access |
| CVE-2026-6912 | Cognito User Pool | Improperly controlled attribute modification | PR 165 | Authenticated privilege escalation |
Affected Systems and Versions
The vulnerability affects all AWS Ops Wheel v2 deployments from PR 147 through PR 163. The v1 API is explicitly noted as not affected.
Any organization running a forked or derivative version of AWS Ops Wheel v2 within this range should assume it is vulnerable unless it has independently restricted Cognito UserPoolClient WriteAttributes.
Vendor Security History
The simultaneous disclosure of CVE-2026-6911 and CVE-2026-6912 shows that the v2 rewrite of AWS Ops Wheel introduced fundamental authentication and authorization weaknesses that v1 did not have. CVE-2026-6911 allowed complete authentication bypass through missing JWT signature verification, and CVE-2026-6912 allowed privilege escalation through unrestricted Cognito attribute writes. Together they are a significant security lapse in the v2 API. AWS did handle the disclosure in a coordinated, structured way and published clear remediation guidance.
