A vulnerability in the awslabs/tough library prior to version 0.22.0 allows remote authenticated users with delegated signing authority to bypass integrity checks on delegated targets metadata. This occurs because delegated metadata validation lacks expiration, hash, and length enforcement, enabling poisoning of the local metadata cache. The issue affects tough versions 0.9.0 through 0.21.x and tuftool versions before 0.15.0. The flaw has been fixed in tough 0.22.0 and tuftool 0.15.0. No workarounds are known.