One Cyrillic Letter, and the Identity Provider Was Theirs
This piece is my read on research published by Doyensec. The findings are theirs; the argument about what they mean is mine. Their original write-up is worth reading in full.
Somebody replaced one English letter with an identical-looking Cyrillic one. And with that, took over the authentication system of an entire organisation.
Not through a vulnerability. Not through malicious code. Through a letter that looks exactly the same but differs at the byte level.
Let me explain.
How it works
In AWS Cognito you can connect several Identity Providers to the same User Pool. The system checks that each Provider’s name is unique. But the check is at the byte level, not the visual one.
So somebody registered a Provider called LеgitCorp. Looks normal to you? That е is not a Latin e. It is U+0435, a Cyrillic letter that looks completely identical.
And the system accepted it. Two Providers that look the same in the interface, in the logs, in the CLI, everywhere – but as far as the system is concerned, entirely different.
Now think about what happens when somebody routes users to the fake Provider. They see a login screen that looks legitimate. They enter a password. End of story.
And that is only the beginning
The researchers at Doyensec showed several more scenarios. One of them: sending a sub claim containing an underscore that confuses the parser. One part of the code reads it as one user. Another part reads it as a different user. That is privilege escalation.
Another: registering an IdP Identifier on a domain nobody had claimed, with no validation of domain ownership. Suddenly every user of that domain arrives at your page.
The problem is not a specific bug
The problem is that cloud providers give you astonishingly sophisticated tools with defaults that invite disaster.
I see it all the time at clients. The infrastructure is configured correctly. IAM is in order. Encryption is on. And the service itself is configured in a way that opens an enormous back door. Because nobody read all the documentation. Because nobody thought a Cyrillic letter could break authentication. Because everybody trusts the cloud as though it were magic.
The cloud is not magic. It is a tool. And a tool you do not understand deeply is a dangerous tool.
So next time somebody tells you they are secure because they are on AWS, ask them whether they know the difference between e and е. If they do not understand the question, you have a problem.
I first shared a version of this as a LinkedIn post on 2026-05-21. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula
