Improper Certificate Validation in ExAws SNS by ExAws

CVE-2026-47074

What is CVE-2026-47074?

The ExAws SNS module contains an improper certificate validation vulnerability that can allow an unauthenticated attacker to perform signature spoofing. Specifically, the issue arises from the 'verify_message/1' function, which retrieves a signing certificate from the 'SigningCertURL' field of incoming SNS messages without ensuring the URL is secure or originates from a legitimate AWS domain. This oversight can let an attacker supply a malicious SigningCertURL, resulting in the acceptance of forged SNS messages. The affected versions include ex_aws_sns from 2.0.1 to just below 2.3.5.

References