CVE-2026-49204: Hard-coded AWS Cognito Testing Accounts
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Remove or disable any leftover debug modules that contain fixed credentials for internal AWS Cognito test sandboxes to prevent asset exploitation.
- Operational
Rotate/revoke any AWS Cognito test sandbox credentials that may have been embedded in the debug modules.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49204?
CVE-2026-49204 has a medium severity rating of 6.9 according to the CVSS scoring system.
How do I fix CVE-2026-49204?
To fix CVE-2026-49204, ensure that any leftover debug modules are removed and do not contain hard-coded AWS Cognito credentials.
What risks does CVE-2026-49204 pose?
CVE-2026-49204 poses risks of asset exploitation due to the presence of hard-coded credentials for internal AWS Cognito testing accounts.
Which software is affected by CVE-2026-49204?
CVE-2026-49204 affects Amazon Web Services Cognito components.
When was CVE-2026-49204 published?
CVE-2026-49204 was published on June 4, 2026.