AWS IAM Security Flaw Exposed: Can Your Username Keep a Secret?
Watch out for CVE-2025-0693! AWS IAM login flow had a flaw that let sneaky actors play detective with response times to guess usernames. AWS has nipped it in the bud by adding a uniform delay, so time-traveling hackers, your tricks won’t work here! No customer action needed, except maybe a victory dance.
Hot Take:
Well, well, well… looks like AWS IAM’s sign-in flow decided to play peek-a-boo with usernames. If hackers were hoping to guess their way to the jackpot, AWS just pulled the rug from under their feet by introducing a ‘delay of game’ penalty. Time to slow that roll, cyber bad guys!
Key Points:
- CVE-2025-0693 allows hackers to potentially enumerate AWS IAM usernames via server response times.
- Username exposure alone does not grant access to AWS resources; full authentication is still required.
- AWS fixed the issue by standardizing response times, eliminating time-based hints.
- No action is needed from customers, but sign-in activities can be monitored using AWS CloudTrail.
- Rhino Security Labs worked with AWS to disclose the vulnerability responsibly.
Already a member? Log in here