CVE-2026-47074 Details
Description
Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines 'Elixir.ExAws.SNS':verify_message/1, 'Elixir.ExAws.SNS.PublicKeyCache':get/1. 'Elixir.ExAws.SNS':verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification. This issue affects ex_aws_sns: from 2.0.1 before 2.3.5.
A vulnerability in the ExAws.SNS and ExAws.SNS.PublicKeyCache modules of the ex_aws_sns package, versions 2.0.1 prior to 2.3.5, allows for signature spoofing due to improper validation of certificate URLs. The issue arises because the 'verify_message/1' function retrieves the signing certificate from the 'SigningCertURL' field of incoming SNS messages without ensuring that the URL is HTTPS or that it belongs to an AWS-owned domain. This flaw enables an unauthenticated attacker to post to an endpoint that invokes 'verify_message/1', supply a malicious 'SigningCertURL', and sign a forged SNS message, bypassing the signature verification process entirely.
Users can update to ex_aws_sns version 2.3.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-47074.html | EEF | AdvisoryVendor |
| https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48 | EEF | Source CodeVendor |
| https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx | EEF | AdvisoryExploitVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-47074 | EEF | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | EEF |
Affected Products
| Product | Versions |
|---|---|
| ex_aws_sns | >= 2.0.1, < 2.3.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | EEF |