PKCS7_verify() performs certificate chain validation when processing PKCS7 objects. In AWS‑LC, the implementation allows an unauthenticated user to bypass the verification for all but the final signer, effectively disabling the check for intermediate certificates. This flaw can be exploited by supplying a crafted PKCS7 object that is accepted as valid, allowing an attacker to create a trusted‑looking certificate chain, which is inferred from the description although not explicitly stated.

Amazon Web Services (AWS) does not need to take action. Applications that link directly against the AWS‑LC library, such as custom cryptographic tools or services that perform PKCS7 processing, are vulnerable if they use any AWS‑LC version earlier than 1.69.0. The vulnerability is confined to the library; it does not affect customers who rely solely on AWS cloud services.

The CVSS base score of 8.7 marks this a high‑severity vulnerability. With an EPSS below 1% the likelihood of exploitation is low, and it is not listed in the CISA KEV catalog. The attack vector is external and does not require privileged access. Based on the description, it is inferred that an attacker could forge certificate chains, potentially leading to authentication bypass or other malicious activity in any system that accepts the forged PKCS7 objects.