Improper signature validation in PKCS7_verify() in AWS‑LC allows an unauthenticated user to bypass verification when processing PKCS7 objects that contain authenticated attributes. This flaw means that forged signatures can be accepted as valid, potentially enabling an attacker to impersonate legitimate signers or perform unauthorized operations that rely on signature authenticity and integrity.

The vulnerability exists in the AWS‑LC library from Amazon Web Services. The advisory does not specify all affected version ranges, but customers using legacy AWS‑LC binaries should upgrade to at least version 1.69.0, which includes the fix. No other vendors or products are listed.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is reported as less than 1 %, suggesting that exploitation is considered unlikely at the time of analysis. The flaw is not listed in CISA’s KEV catalog. The attack vector is not explicitly stated in the advisory; it is inferred that an attacker would need to supply a crafted PKCS7 object to a vulnerable application that uses AWS‑LC's PKCS7_verify function, thus the vulnerability can be exploited remotely or locally depending on how the library is accessed.