An improper certificate validation flaw exists in the identity provider connection components of the Amazon Athena ODBC driver, allowing a man‑in‑the‑middle attacker to intercept authentication credentials when the driver connects to external identity providers. The vulnerability is characterized by insufficient default transport security and is classified as a certificate validation error (CWE‑295). It does not affect connections directly to Amazon Athena itself, only to third‑party identity systems.

The flaw affects versions of the Amazon Athena ODBC driver released before 2.1.0.0, including builds for Linux, macOS (Intel and Apple Silicon), and Windows platforms. The affected driver maintains connections to external identity providers and is deployed in environments where Athena clients rely on external authentication.

The CVSS score of 9.1 highlights a high severity, while the EPSS score below 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known active exploit, yet the attack vector is remote and could be realized by compromising network traffic between client and the identity provider. The impact includes possible disclosure of credentials and further unauthorized access to Athena resources.