A flaw exists in Amazon Athena ODBC driver versions earlier than 2.1.0.0 where special elements within authentication parameters are not properly neutralized. The driver processes these elements during user‑initiated authentication, which may allow a threat actor supplying specially crafted connection settings to cause the driver to execute arbitrary code or to redirect authentication flows. The vulnerability is a form of command injection, corresponding to CWE-77.

The affected product is the Amazon Athena ODBC driver installed on Windows, macOS, and Linux operating systems. Any installation of a driver package with a version prior to 2.1.0.0 on these platforms is subject to the issue.

The CVSS score of 7.3 indicates a high level of severity, while an EPSS score of less than 1% suggests a low likelihood of widespread exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves an attacker injecting malicious connection parameters during a normal authentication attempt; however, this inference is drawn from the advisory and not confirmed by additional evidence.