Description
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS | AWS Sign-in IAM Login Flow | N/A | — |
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-002/ vendor-advisory