A vulnerability in the awslabs/tough library before version 0.22.0 allows remote authenticated users to bypass the TUF delegated role signature threshold by duplicating a valid signature. This flaw permits acceptance of forged delegated role metadata due to improper verification of signature uniqueness. The issue is fixed in tough 0.22.0 and tuftool 0.15.0. No known workarounds exist.