Product
Amazon Cognito
- First Reported
- Dec 20, 2024
- Latest Reported
- Sep 18, 2026
Reported Context (3)
- Our test rig simulated an MCP server that required an Amazon Cognito Bearer token and had access to personally identifiable information (PII) such as names, phone numbers or the last four digits of Social Security Researchers Show Prompt Injection Can Expose AWS AgentCore Identity Credentials
- The best way is to enforce server-side authentication with providers such as OAuth or Cognito, and to ensure AI prompts always treat client-side code as publicly exposed. Wiz Finds Common Security Risks in Vibe-Coded Apps and Offers Mitigations
- Cognito is a service for customer identity and access management. It offers an API called GetCredentialsForIdentity which is passed an identity ID, which is just a region and GUID value, and will return AWS session How AWS Services Provide Credentials—and Where Attackers May Find Them
People (2)
MITRE ATT&CK (8)
Vendors (4)
Products (20)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.