A critical vulnerability in the dcap-qvl library allows attackers to bypass cryptographic verification of the QE Identity signature. This flaw enables forging of QE Identity data to whitelist malicious or non-Intel Quoting Enclaves, undermining the remote attestation security model. The issue affects all deployments using dcap-qvl for SGX or TDX quote verification. The vulnerability is patched in version 0.3.9, which adds the missing verification and enforces policy checks. No workarounds exist; upgrading to the fixed version is required.