The Amazon Athena ODBC driver contains an authentication component that does not correctly neutralize special elements within connection parameters in versions prior to 2.1.0.0. When a user initiates authentication, the driver processes the supplied parameter string without escaping control characters, creating a command‑injection style flaw (CWE‑77). This flaw allows an attacker who supplies a specially crafted connection string to execute arbitrary code on the host running the driver or to redirect authentication flows.

The affected product is the Amazon Athena ODBC driver. All supported platforms – Windows, macOS, and Linux – are impacted for any driver package whose version is older than 2.1.0.0, as documented in the release notes for each platform.

The CVSS score of 7.3 indicates a high severity, but the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an adversary crafting a malicious connection string and delivering it to a user or application that invokes the ODBC driver for authentication. This inference is drawn from the advisory’s description that the flaw is triggered during user‑initiated authentication, and no other exploitation details are publicly reported.