CAI Content Credentials contains an Improper Input Validation flaw that enables a security feature bypass. The vulnerability allows an attacker to override protective checks and obtain unauthorized write privileges, potentially modifying protected data or executing additional malicious actions. No user interaction is required for exploitation, meaning an adversary can trigger the flaw remotely. The weakness maps to CWE‑20 and is rated with a CVSS score of 7.5, indicating a high severity risk to confidentiality, integrity, and availability of the affected systems.

Adobe’s CAI Content Credentials suite, including the C2PA Tool, Content Credentials JavaScript SDK, and Rust SDK, are impacted. Version information is not supplied in the advisory, so all releases containing the vulnerable code are potentially affected. System administrators should verify the exact build versions used and check Adobe’s recommendations for updates.

The CVSS score of 7.5 highlights significant impact, while the EPSS score of less than 1% suggests the attack has low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, so it is not known to be actively exploited at large scale. Based on the description, the likely attack vector is remote, exploiting the Content Credentials API or related input channels. An attacker who can supply crafted data to the vulnerable components can bypass security controls and gain write access without needing to trick a user.