CAI Content Credentials contains an Improper Input Validation flaw that allows attackers to bypass security controls and obtain unauthorized write access. The vulnerability is in the handling of user‑provided data by the C2PA Tool, Content Credentials JS SDK, and Content Credentials Rust SDK. Exploitation does not require user interaction and can be achieved by supplying crafted input to the vulnerable components.

Adobe C2PA Tool, Adobe Content Credentials JS SDK, and Adobe Content Credentials Rust SDK are all affected. Version information is not specified in the advisory.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1 % suggests low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Likely attack vector involves submitting malicious input to the SDKs or tools, enabling unauthorized write operations. Because no user interaction is required, the flaw could be exploited remotely by any entity that can supply data to the vulnerable component.