The vulnerability in CAI Content Credentials is an Improper Input Validation flaw that allows an attacker to bypass built‑in security checks and obtain write privileges. Because the flaw does not require user interaction, an unprivileged party could supply malformed data to provoke the bypass, thereby overriding content‑credential checks and potentially altering protected assets.

Affected are Adobe’s C2PA Tool as well as the Content Credentials JavaScript and Rust SDKs. No explicit version information is provided, so any version still shipped with the original flaw may be vulnerable.

The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% indicates a low current likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. However, because exploitation does not require user interaction and relies on malformed input, an attacker could remotely or locally supply crafted data to trigger the bypass. If successful, the attacker would be able to write data or files that bypass content‑credential checks, potentially undermining the integrity of protected assets.