A missing JWT signature check in AWS Ops Wheel lets attackers forge authentication tokens, allowing them to access the application as an administrator. This grants full read, modify, and delete rights across all tenants and the ability to manage Cognito user accounts, thereby compromising confidentiality, integrity, and availability of the data stored within the deployment.

The vulnerability affects AWS Ops Wheel deployments. No specific version numbers are listed, so any instance running the vulnerable code—including forks or derivative projects that have not applied the patch—remains at risk.

The CVSS score of 9.3 indicates a critical severity, and while the EPSS score is below 1%, indicating low current exploitation probability, the vulnerability is not tracked in the CISA KEV catalog. Attackers would need to send a crafted JWT to the API Gateway endpoint, an action that can be performed over the network from any remote host. Once the forged token is accepted, the attacker gains unrestricted administrative capabilities, making this a serious risk in environments where AWS Ops Wheel is exposed to untrusted traffic.