Amazon’s Athena ODBC driver contains insufficient authentication controls in its browser‑based authentication components. The flaw, present in all releases before 2.1.0.0, can allow an attacker to intercept or hijack authentication sessions when a user initiates a connection. This compromise could enable unauthorized individuals to gain access to data queried through Athena, affecting confidentiality and integrity of the underlying datasets.

The affected vendor is Amazon, with the product Amazon Athena ODBC driver. All versions released prior to 2.1.0.0 are vulnerable. The flaw exists across platforms supporting the driver, including Linux, macOS (Intel and arm), and Windows, as indicated by the associated platform enumerations.

The CVSS severity rating of 9.1 indicates high impact. However, the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity. The likely attack vector involves a user or a local attacker leveraging the browser‑based authentication flow to compromise credentials; thus, mitigations should focus on applying the vendor’s approved patch and avoiding the use of older drivers.