CAI Content Credentials contains an improper input validation flaw that allows attackers to bypass security controls and write data without authorization. By sending crafted input, an adversary can exploit the vulnerability to flip verification checks, enabling actions that are normally restricted. The flaw is not limited to user interaction and therefore can be triggered automatically once the malicious input reaches the vulnerable component.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are affected. No specific version ranges are provided, so any installation of these products should be considered at risk until patched or updated to an unaffected release.

The CVSS score of 7.5 highlights a high severity. The EPSS score of less than 1% indicates that, at present, exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, attackers can leverage the lack of input validation to bypass security measures and gain write access, a risk that persists regardless of current exploitation probability. The likely attack vector involves sending malicious data to the SDKs or tooling components, which can occur without user interaction.