CAI Content Credentials suffers from an improper certificate validation flaw that permits an attacker to bypass security checks, enabling unauthorized write operations on protected assets. The flaw is identified as CWE‑295 and does not require any user interaction to be exploited, meaning that malicious content could be delivered and processed automatically by the affected components.

Adobe’s C2PA Tool, the Content Credentials JavaScript SDK and the Rust SDK are all affected. No specific version ranges were listed, so the current releases of these products are assumed vulnerable until an official update is applied.

The CVSS score of 7.5 indicates a high severity, yet the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no evidence of widespread active exploitation yet. Based on the description, the likely attack vector is remote, where an attacker injects content with a forged or unsigned certificate into systems that use these SDKs or the C2PA Tool. The attack does not require user interaction, making it particularly insidious for automated or unattended systems.