CVE-2026-90513
Received Received - Intake

Authentication Bypass in simalexan API Lambda SES

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message causes missing authentication. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90513
EUVD
EUVD-2026-76985

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
simalexan api-lambda-send-email-ses to bda6869aa81371d1e872242e74fe7d953edb818d (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the simalexan api-lambda-send-email-ses component. It allows unauthenticated remote attackers to manipulate email parameters (toEmails, ccEmails, replyToEmails, subject, message) in the API Gateway Endpoint. The flaw causes missing authentication, enabling attackers to send emails via AWS SES without proper authorization.

Detection Guidance

Check for unauthenticated POST requests to /send endpoints in your API Gateway logs. Look for unusual email sending activity from your Lambda function execution logs. Verify if the SES service is being triggered by unexpected sources.

Impact Analysis

An attacker could exploit this to send unauthorized emails, consume SES resources, or abuse the configured sender identity. This may lead to spam, phishing, or resource exhaustion. The lack of rate limits or input validation exacerbates the risk of abuse.

Mitigation Strategies

Add authentication to the POST /send endpoint. Implement input validation for email parameters. Set up rate limiting to prevent abuse. Review and restrict IAM policies for the Lambda function to least privilege.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart