Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-11931
PUBLISHED
More InfoOfficial Page
Assigner-AMZN
Assigner Org ID-ff89ba41-3aa1-4d27-914a-91399e9639e5
View Known Exploited Vulnerability (KEV) details
Published At-15 Jun, 2026 | 18:33
Updated At-15 Jun, 2026 | 20:08
Rejected At-
▼CVE Numbering Authority (CNA)
Insecure Permissions on Authentication Token Cache File in Kiro IDE

Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.

Affected Products
Vendor
AWS
Product
Kiro IDE
Platforms
  • Linux
  • MacOS
Default Status
unaffected
Versions
Affected
  • From 0 before 0.11.133 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-276CWE-276 Incorrect default permissions
Type: CWE
CWE ID: CWE-276
Description: CWE-276 Incorrect default permissions
Metrics
VersionBase scoreBase severityVector
4.06.8MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
3.15.5MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Version: 4.0
Base score: 6.8
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Version: 3.1
Base score: 5.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-1CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
CAPEC ID: CAPEC-1
Description: CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
Solutions
Configurations
Workarounds
Exploits
Credits
finder
BeyondTrust Phantom Labs
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kiro.dev/changelog/ide/0-11/#patch-0-11-133
release-notes
https://aws.amazon.com/security/security-bulletins/2026-045-aws/
vendor-advisory
Hyperlink: https://kiro.dev/changelog/ide/0-11/#patch-0-11-133
Resource:
release-notes
Hyperlink: https://aws.amazon.com/security/security-bulletins/2026-045-aws/
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found