The inception of certificateless aggregate signature (CLAS) schemes in constrained bandwidth scenarios has made great progress in recent times. CLAS is used widely in many IoT applications such as vehicular ad-hoc networks (VANETs), healthcare sectors, industrial internet of things (IIoT), e-voting, smart homes, and an endless list. Very recently Xiong et al. proposed a collusion-resistant aggregate signature scheme without using certificates for VANETs. The security of the scheme was based on the hardness of ECDLP and security is shown by analyzing the random oracle model to imply that the scheme is unforgeable against the attack of Type \(\mathcal {I}\) and Type \(\mathcal{I}\mathcal{I}\) adversaries. Unfortunately, we demonstrate by performing a Type \(\mathcal{I}\mathcal{I}\) attack that the scheme is not suitable for deployment in practical IoT applications as it can not withstand the attack. Further, we also give the reason for its vulnerability. Then the improvement of the scheme is presented to make it more stable and to be able to withstand the Type \(\mathcal{I}\mathcal{I}\) adversary attack. The specific improvement of the scheme is to make the scheme Type \(\mathcal{I}\mathcal{I}\) attack-resistant. The improved scheme can be deployed in any network system that has constrained bandwidth scenarios with a large number of users.