What is the official website of Amazon Developer ?

The official website of Amazon Developer is https://developer.amazon.com/apps-and-games.

What is Amazon Developer's cybersecurity risk score?

Amazon Developer has an AI-generated cybersecurity risk score of 751 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Amazon Developer experienced?

According to Rankiteo, Amazon Developer currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Amazon Developer been affected by any supply chain cyber incidents ?

According to Rankiteo, Amazon Developer has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: Amazon Web Services (AWS) (Incident ID: HEAAMA1782153018) LiteLLM (Incident ID: LIT1783694475) SimpleHelp Ltd (Incident ID: SIM1781576629) npm, Inc. (Incident ID: ELAGITAMAOPENPM1780050263) Laravel (Incident ID: LAR1782311560) Socket (Incident ID: AWSSOC1778833973) Braintrust (Incident ID: AMAUSE1778092688) Amazon Web Services (AWS) (Incident ID: LIMAMA1777312775) Vercel (Incident ID: AMAVERGITSTR1775204764) Amazon Web Services (AWS) (Incident ID: AMASTA1775118743) Aqua Security (Incident ID: AQUUSEAMASALCIS1775046662) Amazon Web Services (AWS) (Incident ID: EUR1774635987) Amazon Web Services (AWS) (Incident ID: SALAMAMICPINRED1774269319) NPM (Incident ID: GOOAMANPMGIT1773319158) Amazon Web Services (AWS) (Incident ID: RELLEX1772562253) Amazon Web Services (AWS) (Incident ID: EUR1774628727) Amazon (Incident ID: AMAAPPMIC1770935300) ConnectWise (Incident ID: SMASIMCONAMADAT1775551328) Cisco (Incident ID: CISSAI1773859283) Amazon (Incident ID: LASAMA1769009064) LinkedIn (Incident ID: LINAWS1766995316) Microsoft Security (Incident ID: AMAORAMIC1770695748) Amazon Web Services (AWS) (Incident ID: AMAAWS1770152164) Cisco (Incident ID: SAL5732257091825) Wiz (Incident ID: AMAWIZ1768515615) NPM (Incident ID: GOONPMORGGOVAPPMETTHEAWSTIKK7-1773672350) Fortinet (Incident ID: FORCISAMAJPM1767748297)

Does Amazon Developer have SOC 2 Type 1 certification ?

According to Rankiteo, Amazon Developer is not certified under SOC 2 Type 1.

Does Amazon Developer have SOC 2 Type 2 certification ?

According to Rankiteo, Amazon Developer does not hold a SOC 2 Type 2 certification.

Does Amazon Developer comply with GDPR ?

According to Rankiteo, Amazon Developer is not listed as GDPR compliant.

Does Amazon Developer have PCI DSS certification ?

According to Rankiteo, Amazon Developer does not currently maintain PCI DSS compliance.

Does Amazon Developer comply with HIPAA ?

According to Rankiteo, Amazon Developer is not compliant with HIPAA regulations.

Does Amazon Developer have ISO 27001 certification ?

According to Rankiteo,Amazon Developer is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Amazon Developer operate in ?

Amazon Developer operates primarily in the Consumer Electronics industry.

How many employees does Amazon Developer have ?

Amazon Developer employs approximately 1 people worldwide.

Does Amazon Developer own any subsidiaries ?

Amazon Developer presently has no subsidiaries across any sectors.

How many LinkedIn followers does Amazon Developer have ?

Amazon Developer's official LinkedIn profile has approximately 11,286 followers.

Does Amazon Developer have a Crunchbase profile ?

No, Amazon Developer does not have a profile on Crunchbase.

Does Amazon Developer have a LinkedIn profile ?

Yes, Amazon Developer maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/amazon-appstore-developers.

How many cybersecurity incidents has Amazon Developer experienced ?

As of August 2, 2026, Rankiteo reports that Amazon Developer has experienced 74 cybersecurity incidents.

How many peer or competitor companies does Amazon Developer have ?

Amazon Developer has an estimated 576 peer or competitor companies worldwide.

What types of cybersecurity incidents has Amazon Developer faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Cyber Attack, Breach, Ransomware and Data Leak.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Amazon Developer

Boost Score +25 with badge (5 left)

751

/1000

Fair

776

/1000

Fair

Amazon Developer Vendor Cyber Rating & Cyber Score

amazon.com

Add Your Compliance Badge

Giving developers the tools to build awesome apps and games, and reach millions of consumers worldwide.

Amazon Developer A.I CyberSecurity Scoring

Scoring History

Amazon Developer

Amazon Developer CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Amazon Science

Vulnerability

100

7/2026

AMAORATUXROC178...

Amazon Science

Vulnerability

7/2026

ANYWINGOOAMAAUG...

Amazon

Vulnerability

6/2026

AMA1782498585

Amazon Web Services...

Vulnerability

6/2026

AMA1782541446

Amazon Web Services...

Vulnerability

6/2026

Amazon Web Serv...

HEAAMA178215301...

Amazon

Vulnerability

100

6/2026

ANTAMA178355044...

Amazon Web Services...

Vulnerability

6/2026

LiteLLM

LIT1783694475

AWS Startups

Vulnerability

100

6/2026

SimpleHelp Ltd

SIM1781576629

Amazon Web Services...

Cyber Attack

100

6/2026

GOOAMA178116664...

Amazon Web Services...

Cyber Attack

5/2026

npm, Inc.

ELAGITAMAOPENPM...

Amazon Science

Vulnerability

5/2026

OPEANTAMAXAI177...

Amazon Web Services...

Vulnerability

100

5/2026

Laravel

LAR1782311560

AWS for Healthcare ...

Cyber Attack

5/2026

Socket

AWSSOC177883397...

Amazon Science

Breach

5/2026

Braintrust

AMAUSE177809268...

Amazon Web Services...

Vulnerability

100

5/2026

APPGOOAMA178163...

Amazon Web Services...

Cyber Attack

4/2026

Amazon Web Serv...

LIMAMA177731277...

Amazon

Cyber Attack

4/2026

ELFTEMCOUGRUAMA...

Amazon Web Services...

Cyber Attack

4/2026

Vercel

AMAVERGITSTR177...

Amazon Web Services...

Vulnerability

100

4/2026

Amazon Web Serv...

AMASTA177511874...

AWS Partners

Vulnerability

4/2026

AWSGITSTR177516...

Amazon Web Services...

Vulnerability

100

4/2026

Aqua Security

AQUUSEAMASALCIS...

Amazon Web Services...

Vulnerability

100

3/2026

DELMICAMAFORSPL...

Amazon Web Services...

Cyber Attack

3/2026

Amazon Web Serv...

EUR1774635987

Amazon Web Services...

Vulnerability

100

3/2026

Amazon Web Serv...

SALAMAMICPINRED...

Amazon Web Services...

Vulnerability

3/2026

AMA1773707045

Amazon Web Services...

Cyber Attack

3/2026

NPM

GOOAMANPMGIT177...

Amazon Web Services...

Vulnerability

3/2026

AMA1772792723

Amazon Web Services...

Cyber Attack

100

3/2026

AMA1772678135

Amazon Web Services...

Breach

100

3/2026

Amazon Web Serv...

RELLEX177256225...

Amazon

Cyber Attack

3/2026

AMA1775744757

Amazon Web Services...

Breach

3/2026

Amazon Web Serv...

EUR1774628727

Amazon

Vulnerability

100

2/2026

Amazon

AMAAPPMIC177093...

Amazon

Cyber Attack

2/2026

ConnectWise

SMASIMCONAMADAT...

Amazon

Breach

2/2026

AMA1770339008

Amazon

Cyber Attack

2/2026

AMAINSCOIGOOFLI...

Amazon

Cyber Attack

2/2026

AMA1773987972

AWS Partners

Breach

1/2026

AWSDIGOVH176978...

Amazon

Vulnerability

100

1/2026

Cisco

CISSAI177385928...

Amazon

Cyber Attack

1/2026

Amazon

LASAMA176900906...

AWS Databases & Ana...

Cyber Attack

1/2026

HUNAWS177273537...

Amazon Web Services...

Vulnerability

100

1/2026

GOOAMAOPEANT177...

AWS Partners

Cyber Attack

12/2025

LINAWS176699531...

Amazon Web Services...

Cyber Attack

100

12/2025

Microsoft Secur...

AMAORAMIC177069...

Amazon

Vulnerability

12/2025

AMAUNIGOOWAK176...

Amazon Web Services...

Cyber Attack

100

12/2025

KUBNVITENALIAMA...

Amazon Web Services...

Breach

100

11/2025

Amazon Web Serv...

AMAAWS177015216...

Amazon Web Services...

Cyber Attack

11/2025

AMA1765965358

AWS Databases & Ana...

Cyber Attack

100

11/2025

AWS1783621498

Amazon Developer

Cyber Attack

100

10/2025

AMA023220210212...

Amazon Developer

Cyber Attack

9/2025

AMA409264009232...

AWS Partners

Cyber Attack

100

9/2025

Cisco

SAL573225709182...

Amazon Web Services...

Vulnerability

100

9/2025

Wiz

AMAWIZ176851561...

For Industries

Vulnerability

8/2025

NPM

GOONPMORGGOVAPP...

Amazon Developer

Cyber Attack

7/2025

RIN709072225

Amazon Developer

Vulnerability

6/2025

AMA505082225

Amazon Developer

Ransomware

100

5/2025

AMA503215011212...

Amazon Web Services...

Vulnerability

100

12/2024

Fortinet

FORCISAMAJPM176...

Amazon Developer

Vulnerability

8/2024

AMA000082124

Amazon Developer

Breach

7/2024

AMA000072524

Amazon Developer

Cyber Attack

100

6/2024

AMA190211910222...

Amazon Developer

Breach

09/2023

WHO04111223

Amazon Developer

Vulnerability

6/2023

AMA016210111072...

Amazon Developer

Data Leak

10/2021

TWI19174123

Amazon Web Services...

Cyber Attack

100

6/2021

AMA1768595116

Amazon Developer

Breach

100

01/2021

RIN01518622

Amazon Web Services...

Cyber Attack

100

6/2020

AMA1780793273

Amazon Developer

Data Leak

01/2020

AMA21461222

Amazon Developer

Data Leak

01/2020

RIN211261222

Amazon Developer

Data Leak

12/2019

RIN2178523

Amazon Web Services...

Vulnerability

3/2019

AMA1781685326

Amazon

Breach

6/2018

TIKAMA176901658...

Amazon Developer

Data Leak

02/2018

AMA350181223

Amazon Developer

Breach

3/2017

WHO631090125

Amazon Developer

Cyber Attack

01/2016

AMA0417522

Loading…

A.I.

Amazon Developer Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Amazon Developer

Incidents vs Consumer Electronics Industry Avg (This Year)

No incidents recorded for Amazon Developer in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Amazon Developer in 2026.

Incident Types Amazon Developer vs Consumer Electronics Industry Avg (This Year)

No incidents recorded for Amazon Developer in 2026.

Incident History - Amazon Developer (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Amazon Developer Subsidiaries

Amazon Developer

Consumer Electronics

Website: https://developer.amazon.com/apps-and-games

Company Size: 1

Amazon Web Services (AWS)IT Services and IT Consulting

AWS Training & CertificationIT Services and IT Consulting

AWS AIIT Services and IT Consulting

AWS Databases & AnalyticsIT Services and IT Consulting

AWS CareersIT Services and IT Consulting

AWS Machine LearningIT Services and IT Consulting

AWS Executive InsightsInformation Technology & Services

AWS StartupsIT Services and IT Consulting

AWS Executive InsightsInformation Technology & Services

AWS PartnersIT Services and IT Consulting

AWS EventsIT Services and IT Consulting

AWS DevelopersTechnology, Information and Internet

AWS for M&ESoftware Development

AWS for Healthcare & Life SciencesIT Services and IT Consulting

AWS On AirTechnology, Information and Internet

AWS Machine LearningIT Services and IT Consulting

Amazon re:MARSInformation Technology & Services

AWS SupportTechnology, Information and Internet

AWS for TelecomIT Services and IT Consulting

AWS for Retail and Consumer GoodsIT Services and IT Consulting

AWS for Energy & UtilitiesIT Services and IT Consulting

AWS for Financial ServicesIT Services and IT Consulting

AWS for AutomotiveIT Services and IT Consulting

AWS ProductsTechnology, Information and Internet

AWS for IndustrialIT Services and IT Consulting

AWS Machine LearningIT Services and IT Consulting

AWS TVIT Services and IT Consulting

Amazon Web Services Artificial Intelligence Machine LearningIT Services and IT Consulting

AWS for IndustriesIT Services and IT Consulting

AWS TVIT Services and IT Consulting

AWS for Aerospace & SatelliteIT Services and IT Consulting

AmazonSoftware Development

Whole Foods MarketRetail

Whole Planet Philanthropic Fundraising Services

Whole KidsPhilanthropy

Whole CitiesNon-profit Organizations

TwitchSoftware Development

Twitch AdsInternet Publishing

Amazon ScienceResearch Services

Loading…

Amazon Developer Similar Companies

Mia propia de mi

blogger.com

Empresa privada, dedicada a proveer bienes y servicios de calidad a un amplio sector de la población. Empresa privada, dedicada a proveer bienes y servicios de calidad a un amplio sector de la población. Empresa privada, dedicada a proveer bienes y servicios de calidad a un amplio sector de la población.

Samsung Mobile

smsng.co

Samsung Mobile is at the forefront of mobile intelligence, shaping the future with Galaxy AI. With the next evolution of Galaxy AI, we are making lives simpler–reducing stress, creating more time, and getting the help you need without even having to ask. In this era of mobile AI, the freedom to focus on what matters most to you is no longer a dream, but a powerful reality. The future of Galaxy AI is here: more personal, intuitive, and transformative, unlocking endless possibilities and revolutionizing how your Galaxy can work for you. Life opens up with Galaxy AI.

Eldorado LLC

eldorado.ru

Eldorado is one of Russia's largest retailers of consumer electronics and household appliances. The company is present in almost all regions of Russia. Eldorado develops multichannel sales and operates over 600 stores throughout the country. Eldorado LLC is a part of the PPF Group and Emma Capital that are among the largest investment companies in Central and Eastern Europe. Eldorado was founded in 1994; PPF Group entered the company in 2009 by acquiring 50% + 1 share; in 2011 PPF completed a buyout of all remaining shares. Under the management of PPF Group, Eldorado has significantly increased its liquidity and profitability. In mid-March 2014 it was announced that PPF Group and Emma Capital, an investment company, reached an agreement, according to which Emma Capital became a co-owner of Eldorado LLC. In 2014, the company launched b2b sales and expanded its range with new categories: goods for home, garden and repair, goods for children and mothers, textile, etc. The company follows the strategy of a multicategory retailer both online and offline. Eldorado – a five-time winner of the Consumers’ Rights and Quality of Service as the best retail chain, a two-time winner of People's Brand (2012, 2014) as well as a winner of Company of the Year 2012 and HR Brand in 2013 awards. In 2015, Eldorado got The Best Prices award, organized by Hi-Tech.Mail.ru expert project. Eldorado is a two-time winner of Online Retail Russia Awards (2015, 2016) in the category "The Best Online Shop" in consumer electronics household appliances segment and is a two-time winner of EMEA Channel Academy Award: "Russia & CIS. Retailer of the Year" (2015, 2016) as well as Russian Retail Awards 2016. Currently, the number of Eldorado club participants is about 16 million people.

Sharp

https://global.sharp

„ÄêCorporate Name„Äë Sharp Corporation „ÄêHead Office„Äë 1 Takumi-cho, Sakai-ku, Sakai City, Osaka 590-8522, Japan „ÄêManagement Representatives„Äë Masahiro Okitsu, President & Chief Executive Officer „ÄêBusiness Activities„Äë Mainly manufacturing and sales of telecommunications equipment, electric and electronic application equipment, and electronic components. „ÄêSharp Bases in Japan„Äë https://global.sharp/corporate/info/base/ „ÄêSocial Media„Äë https://global.sharp/corporate/info/social/ https://www.facebook.com/Sharp.Global „ÄêRecruit„Äë https://corporate.jp.sharp/recruit/ „ÄêBusiness Philosophy„Äë We do not seek merely to expand our business volume. Rather, we are dedicated to the use of our unique, innovative technology to contribute to the culture, benefits and welfare of people throughout the world. It is the intention of our corporation to grow hand-in-hand with our employees, encouraging and aiding them to reach their full potential and improve their standard of living. Our future prosperity is directly linked to the prosperity of our customers, dealers and shareholders...indeed, the entire Sharp family. „ÄêBusiness Creed„Äë Sharp Corporation is dedicated to two principal ideals: "Sincerity and Creativity" By committing ourselves to these ideals, we can derive genuine satisfaction from our work, while making a meaningful contribution to society. Sincerity is a virtue fundamental to humanity ... always be sincere. Harmony brings strength ... trust each other and work together. Politeness is a merit... always be courteous and respectful. Creativity promotes progress... remain constantly aware of the need to innovate and improve. Courage is the basis of a rewarding life... accept every challenge with a positive attitude.

Loading…

NEWS

Amazon Developer CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

March 21, 2026 06:10 AM

Amazon Lost 6.3 Million Orders to Vibe Coding. Your SOC Is Next.

Amazon mandated AI coding tools and suffered a 6-hour outage costing 6.3 million orders. The same AI quality crisis now emerging in SOC...

Read Article

February 27, 2026 04:19 PM

Endpoint Security and Network Monitoring News for the Week of February 27th: Amazon Web Services (AWS), Myriad360, NVIDIA, and More

The editors have curated a list of noteworthy news about endpoint security and network monitoring from the week of February 27th.

Read Article

December 24, 2025 08:00 AM

AWS IoT Services Alignment with the European Union Cyber Resilience Act (EU CRA) | Amazon Web Services

by Syed Rehan on 24 DEC 2025 in AWS IoT Core, AWS IoT Device Defender, AWS IoT Greengrass, Best Practices, Business Intelligence, Customer Solutions,...

Read Article

December 22, 2025 08:00 AM

A comprehensive list of 2025 tech layoffs

The tech layoff wave is still kicking in 2025. Last year saw more than 150,000 job cuts across 549 companies, according to independent...

Read Article

December 18, 2025 08:00 AM

Amazon Business Partners with Finance, Cybersecurity Software Developers

Amazon officials said that the agreements with financial management software Intuit QuickBooks, cybersecurity firm CrowdStrike and human...

Read Article

December 07, 2025 08:00 AM

Cybersecurity Jobs in India: Top Roles and Salary Trends

While other types of IT jobs like network administrators or software developers are more common and well-known, cyber security jobs are...

Read Article

December 07, 2025 08:00 AM

Cybersecurity Pundits: 2025 List Of Industry Experts

These top experts are available to media outlets for their opinions and insights on cybercrime, cybersecurity, cyberwarfare, national security, privacy, and...

Read Article

December 05, 2025 08:00 AM

Chinese hackers exploiting React2Shell bug impacting countless websites, Amazon researchers say

The bug, tagged as CVE-2025-55182 and referred to colloquially as React2Shell, was reported to Meta by researcher Lachlan Davidson on...

Read Article

November 25, 2025 08:00 AM

Amazon CTO’s 2026 tech predictions include the dawn of the ‘renaissance developer’

Several years ago, Amazon chief technology officer Werner Vogels began sharing predictions on how technology would likely impact our lives...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…