The vulnerability in CAI Content Credentials allows a well‑crafted certificate chain to be accepted even though it is not trusted by the validator. The flaw can be exploited to bypass the security checks that should take place when a content credential is verified, thereby giving an attacker the ability to write or modify protected data. No user interaction is required and the flaw directly undermines the integrity of the credentialing process.

Adobe’s C2PA Tool and the associated JavaScript and Rust SDKs for Content Credentials are affected. Version information is not provided, so any deployment of these components that has not yet patched may be vulnerable.

The CVSS score of 7.5 indicates a high severity for the potential impact, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog, which reduces the likelihood that a widely visible exploit is in use. Exploitation can occur in the data path of the SDK, and the lack of a user interaction requirement implies that a remote attacker who can supply data to the SDK could trigger the bypass.