Description
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Security feature bypass with potential unauthorized write access
Action: Patch
AI Analysis

Impact

CAI Content Credentials contains an improper input validation flaw that allows an attacker to supply crafted data and bypass built‑in security controls. The vulnerability can lead to unauthorized write operations on protected resources without requiring user interaction and could compromise the integrity of content and associated metadata.

Affected Systems

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are affected. All available versions prior to the latest vendor release contain the flaw; no specific version constraints are listed.

Risk and Exploitability

The flaw is assessed with a CVSS score of 7.5 and an EPSS probability of less than 1%, indicating a moderate severity with a low likelihood of exploitation reported at this time. It is not listed in the CISA KEV catalog. Attacks would likely involve sending malicious input through the SDK’s API or associated tooling, and would not require user interaction.

Generated by OpenCVE AI on October 16, 2026 at 02:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Adobe’s latest patch or upgraded release for the C2PA Tool, Content Credentials JavaScript SDK, and Rust SDK to eliminate the validation error.
  • Implement strict input sanitization on any data passed to the SDK, ensuring that only valid and expected formats are accepted.
  • Enforce least‑privilege write permissions on protected resources and audit write operations to detect potential abuse.

Generated by OpenCVE AI on October 16, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe c2pa
Adobe c2pa-web
Adobe c2patool
CPEs cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*
cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*
cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe c2pa
Adobe c2pa-web
Adobe c2patool

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Title CAI Content Credentials | Improper Input Validation (CWE-20)
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Adobe C2pa C2pa-web C2patool
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T18:36:22.887Z

Reserved: 2026-09-25T11:19:19.065Z

Link: CVE-2026-100120

cve-icon Vulnrichment

Updated: 2026-10-14T18:36:19.483Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T22:17:11.173

Modified: 2026-10-15T18:30:15.790

Link: CVE-2026-100120

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T02:30:15Z

Weaknesses
  • CWE-20

    Improper Input Validation