The flaw in awslabs/tough manifests as improper verification of cryptographic signature uniqueness during delegated‑role validation. A remote authenticated user can duplicate a valid signature repeatedly until the required threshold is achieved, causing the client to accept forged delegated role metadata. This vulnerability is a CWE‑347 weakness in signature handling and could enable an attacker to alter role assignments or inject malicious metadata, leading to unauthorized actions.

Affected are AWS’s tough library and its companion tuftool. All releases prior to tough‑v0.22.0 and tuftool‑v0.15.0 are vulnerable, covering the Rust crates and any applications that depend on them.

The CVSS score of 7 reflects high severity, but the EPSS score of less than 1% indicates that exploitation is presently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the TUF client and must craft duplicate signatures; if successful, the client will blindly accept the forged role metadata and may be misled into trusting malicious updates.