CAI Content Credentials suffers from an improper verification of a cryptographic signature, allowing an attacker to bypass built‑in security checks and obtain unauthorized write privileges. The flaw is fundamental: any credentials that rely on the faulty signature verification can be forged, effectively disabling the protection intended by the Content Credentials framework. This gives an attacker the ability to modify, replace, or delete protected content without needing to authenticate normally.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are the affected products. No specific version information is listed, so all current releases may be vulnerable until a patch is released.

The vulnerability has a CVSS score of 7.5, indicating high severity, while the EPSS score is below 1%, suggesting a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as no user interaction is required. An attacker could likely inject a forged credential or manipulated content that passes signature checks, then execute write operations that would otherwise be denied.