The flaw is an improper certificate validation vulnerability that allows an attacker to bypass CAI Content Credentials’ security checks and gain unauthorized write access. Because the certificate path is not fully verified, a forged or mis‑signed certificate can be accepted by the system, enabling data injection without triggering normal authentication steps. This leads to a breach of data integrity and confidentiality, and it is a direct instance of CWE-295, improper certificate validation.

The affected components are Adobe’s C2PA Tool, Content Credentials JavaScript SDK, and Content Credentials Rust SDK. The advisory does not list specific versions; therefore, all released versions of these components may be impacted until Adobe releases an updated release that corrects the certificate validation logic.

The CVSS score of 7.5 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests that exploit attempts are unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, implying that no large‑scale incidents have been reported so far. The attack likely proceeds remotely by supplying a forged or improperly signed certificate, and no user interaction is required, enabling a silent bypass of security controls.