CAI Content Credentials contains an Improper Verification of Cryptographic Signature flaw that allows an attacker to bypass security controls and gain limited write access without user interaction. The weakness, identified as CWE-347, means that signed content can be accepted regardless of its authenticity, potentially allowing an adversary to insert or modify data in a manner that the system treats as legitimate.

The affected products are Adobe’s C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK. No specific version information is provided by the CNA, so all released builds of these components should be considered potentially vulnerable until a patched version is available.

This issue carries a CVSS score of 5.3 and an EPSS score of less than 1 %, indicating a moderate severity with low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the vulnerability can be exploited remotely without user interaction, likely by supplying forged data to the SDK’s signature verification path.