CAI Content Credentials is vulnerable to an improper input validation flaw that lets an attacker bypass built‑in security mechanisms. By supplying specially crafted input, the attacker can gain limited write privileges, potentially modifying content or credential data. The flaw does not require any user interaction, meaning that it can be triggered automatically against affected systems.

The vulnerability affects Adobe products: the C2PA Tool, the Content Credentials JavaScript SDK, and the Content Credentials Rust SDK. No specific affected version numbers are provided, so all installations of these components should be considered potentially vulnerable until a patch is applied.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Exploitation does not require user interaction, implying that the attack vector could be remote and automated; however, the advisory does not explicitly state the attack vector, so this inference is based solely on the lack of user interaction requirement.