CVE-2026-49473: AWS Cedar Policy Express.js middleware authorization bypass via query string manipulation

CVE-2026-49473 · Severity: high · CVSS 8.8 · Published 2026-08-13

A security vulnerability exists in the Cedar authorization middleware for Express.js applications. This middleware is used to control access to different parts of a web application based on security policies. An attacker can bypass these security checks by adding specific characters to a web address, potentially gaining unauthorized access to sensitive administrative functions or private user data.

Vendors: AWS, npm.

Quick answers

Is CVE-2026-49473 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49473 being exploited in the wild.
How severe is CVE-2026-49473?
High severity, with a CVSS score of 8.8, published 13 August 2026.
Which products and versions are affected?
AWS Authorization-For-Expressjs <= 0.2.0; @cedar-policy/authorization-for-expressjs (npm) <= 0.2.0, SEMVER:introduced=0,fixed=0.3.0.
Is there a fix for CVE-2026-49473?
Yes. @cedar-policy/authorization-for-expressjs (npm): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49473 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49473?
Check whether you run AWS Authorization-For-Expressjs or @cedar-policy/authorization-for-expressjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @cedar-policy/authorization-for-expressjs (npm): upgrade to 0.3.0 or later
    npm install @cedar-policy/authorization-for-expressjs@0.3.0

Technical details

The vulnerability is an interpretation conflict (CWE-436) between the Cedar authorization middleware and the Express.js framework. The middleware uses 'req.originalUrl' (which includes the query string) to match requests against Cedar action mappings, while Express routes requests based only on the path component. In applications with overlapping path prefixes (e.g., /users and /users/:id), an attacker can append a query string (e.g., /users/?x=1) to cause the middleware to match a less restrictive policy (like a single user view) while Express executes the more restrictive handler (like the full user list). This allows a remote authenticated attacker to bypass intended authorization constraints. The issue is fixed in version 0.3.0 by switching to 'req.path' for action matching.

Affected products

  • AWS @cedar-policy/authorization-for-expressjs <= 0.2.0

Identifiers

  • CVE-2026-49473
  • GHSA-g4w6-vmgf-xqvx

Timeline

  • 2026-05-07: patched: Version 0.3.0 released
  • 2026-05-26: disclosed: Initial disclosure date
  • 2026-06-30: advisory: GitHub Advisory published/reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.