CVE-2026-6966
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Apr 24, 2026
CISA due date
—
The record
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | tough | 0 | 0.22.0 |
| crates.io | tuftool | 0 | 0.15.0 |
Related vulnerabilities
- GHSA-8m7c-8m39-rv4x awslabs/tough Delegated Roles have a Signature Threshold Bypass Same vulnerability
- GHSA-4v58-8p28-2rq3 awslabs/tough is Missing Delegated Metadata Validation Also affects tough
- CVE-2026-6967 Missing expiration, hash, and length enforcement in delegated metadata validation in… Also affects tough
- CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
- CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347
- CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102273 PyJWT is a Python implementation of JSON Web Token standards. CWE-347