CVE-2026-90513: API Lambda Send Email SES Auth Bypass

CVE-2026-90513 Overview

CVE-2026-90513 is a missing authentication vulnerability [CWE-287] in the simalexan/api-lambda-send-email-ses project, an AWS Lambda function that sends email via Amazon Simple Email Service (SES). The flaw resides in the SES.sendEmail function defined in template.yml, which exposes an API Gateway endpoint without authentication controls. Remote attackers can manipulate the toEmails, ccEmails, replyToEmails, subject, and message parameters to send arbitrary email through the deployed Lambda. The project uses a rolling release model, so no fixed version identifiers exist. The maintainer was notified through a public issue report but has not responded.

Critical Impact
Unauthenticated attackers can abuse deployed instances of the Lambda to send arbitrary email through the victim's AWS SES account, enabling spam, phishing, and SES reputation damage.

Affected Products

simalexan/api-lambda-send-email-ses up to commit bda6869aa81371d1e872242e74fe7d953edb818d
API Gateway Endpoint component defined in template.yml
All rolling-release deployments derived from the upstream project

Discovery Timeline

2026-09-13 - CVE-2026-90513 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90513

Vulnerability Analysis

The project provides a Serverless Application Model (SAM) template that provisions an AWS Lambda function fronted by an Amazon API Gateway endpoint. The Lambda invokes SES.sendEmail using request parameters supplied by the client, including recipients, subject, and message body. Because the API Gateway route defined in template.yml does not enforce an authorizer, API key, or IAM authentication, any remote user who discovers the endpoint URL can invoke it. The issue is classified under [CWE-287: Improper Authentication].

The impact is limited to integrity and availability of the email channel: attackers do not gain access to stored data, but they can send arbitrary messages that appear to originate from the victim's verified SES identities. Repeated abuse can trigger SES bounce and complaint thresholds, resulting in account suspension.

Root Cause

The root cause is a missing authentication requirement on the API Gateway event source declared in template.yml. The template registers the Lambda with a public HTTP method and no Auth block, so API Gateway accepts every unauthenticated request and forwards user-controlled parameters directly to the SES client.

Attack Vector

Exploitation is remote and requires no privileges or user interaction. An attacker sends an HTTP request to the deployed API Gateway endpoint containing crafted toEmails, ccEmails, replyToEmails, subject, and message values. The Lambda relays the request to Amazon SES using the account's IAM permissions, and SES delivers the message. No verified proof-of-concept code is published; see the GitHub Issue #9 and VulDB entry for CVE-2026-90513 for additional technical context.

Detection Methods for CVE-2026-90513

Indicators of Compromise

Unexpected spikes in Amazon SES Send, Bounce, or Complaint CloudWatch metrics tied to the Lambda's execution role
CloudTrail Invoke events on the API Gateway resource from unfamiliar source IP addresses or geographies
Outbound SES messages with recipients, subjects, or bodies inconsistent with the application's normal traffic patterns

Detection Strategies

Review the deployed template.yml for API Gateway events that lack an Auth block or specify Authorizer: NONE
Correlate API Gateway access logs with SES send events to identify unauthenticated senders
Enable AWS WAF logging on the API Gateway stage and alert on high-volume POST traffic to the send-email route

Monitoring Recommendations

Configure CloudWatch alarms on SES bounce and complaint rates approaching AWS reputation thresholds
Forward API Gateway, CloudTrail, and SES logs to a centralized analytics platform for correlation and anomaly detection
Track Lambda invocation counts and alert when volume deviates from the established baseline

How to Mitigate CVE-2026-90513

Immediate Actions Required

Restrict the API Gateway endpoint by adding an authorizer, API key, or IAM authentication in template.yml and redeploying
Move the affected SES identities into the SES sandbox or apply a low sending quota until authentication is enforced
Audit CloudTrail and SES logs for the past 90 days to identify unauthorized use of the endpoint

Patch Information

No vendor patch is available. The project uses a rolling release and the maintainer has not responded to the public issue report. Operators must remediate downstream by modifying their deployment templates. Track the upstream GitHub project and GitHub Issue #9 for updates.

Workarounds

Place the endpoint behind AWS WAF with rate limiting and geo-restriction rules
Enforce a Lambda authorizer that validates a signed token or shared secret before invoking SES.sendEmail
Restrict the Lambda execution role to a narrow set of SES verified identities and enable SES sending authorization policies
Consider replacing the public endpoint with a private API Gateway or VPC-only invocation path

bash

# Example SAM template snippet enforcing API key authentication
Events:
  SendEmail:
    Type: Api
    Properties:
      Path: /send
      Method: post
      Auth:
        ApiKeyRequired: true