The vulnerability in the awslabs/tough library stems from improper enforcement of cryptographic signature uniqueness during delegated‑role validation. An attacker who has authenticated access can simply duplicate a valid signature until the required threshold is met, causing the client to accept forged delegation metadata. This flaw is a CWE‑347 weakness in signature handling and could let an attacker manipulate role assignments or inject malicious metadata, leading to unauthorized actions.

Affected are AWS’s tough library and its companion tuftool. All releases prior to tough‑v0.22.0 and tuftool‑v0.15.0 are vulnerable, covering the Rust crates and any applications that depend on them.

The CVSS score of 7 reflects high severity, but the EPSS score of less than 1% indicates that exploitation is presently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the TUF client and must craft duplicate signatures; if successful, the client will blindly accept the forged role metadata and may be misled into trusting malicious updates.