🎯 New Report #3630605: Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)
🔺Severity: Medium
👽 Reporter: mistercloudsec
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-26
⏰ Disclosed: 2026-07-09 15:31:28
📝 Summary: The Kiro IDE (version 0.11.107) wrote authentication tokens (access token and refresh token) to a file with world-readable permissions (0644). The file contained sensitive information, including the access token, refresh token, and profile ARN. This exposed the credentials to potential unauthorized access by local processes or users.
📂 Report JSON File: 3630605
@hackeronereports