The CAI Content Credentials libraries perform certificate verification incorrectly, allowing an adversary to bypass security checks and obtain unrestricted write permissions within the content validation workflow. This flaw is classified as Improper Certificate Validation and could be leveraged to act as though a legitimate credential was valid. No user interaction is required to exploit the issue, and the vulnerability can be triggered under conditions that the attacker cannot fully control, so the threat surface depends on deployment specifics.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are the affected components. The advisory does not list specific release numbers, so any installed instance that has not applied the latest Adobe security patch may be vulnerable.

With a CVSS score of 5.9 the vulnerability is considered moderate, and the EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation at present. Because it is not listed in the CISA KEV catalog, there are no publicly known exploits. Exploitation requires that the application be using the vulnerable certificate validation logic; if the attacker can drive input through the library but the required flag or configuration is already set, the attack may succeed. The lack of user interaction lowers the barrier somewhat, but the need for specific internal conditions keeps overall risk moderate.