Full ATO (1 Click) via custom metadata manipulation in AWS Cognito Misconfigured Application

Assalamu'alaikum, everyone. It’s been a long time since my last write-up. Today, we have a new finding on an application that uses AWS Cognito from Amazon as an Identity Provider, which uses custom metadata, but custom things always lead to special f...