CAI Content Credentials CVE-2026-100123

Exploitation targets the CAI Content Credentials SDK's certificate-validation logic (CWE-295): the attacker must be able to present certificate material to the SDK that it improperly accepts as valid - typically requiring a position to supply a forged, expired, or untrusted certificate in the trust/verification path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description, no authentication and no user interaction are required, and the stated outcome is a security-feature bypass yielding unauthorized write access. The practical limiting factor is that the attacker must influence the certificate/trust material the SDK validates (e.g., control over a presented signing certificate or the validation input), and impact is confined to integrity (C:N/A:N) - the specific SDK version, integration mode, and exact validation step are not confirmed from the available data and should be verified against Adobe APSB26-163.

CVSS 3.1 base score is 7.5 (High) driven entirely by an integrity impact (I:H) with no confidentiality or availability consequence (C:N/A:N), and the vector reports network-reachable, low-complexity, unauthenticated exploitation with no user interaction (AV:N/AC:L/PR:N/UI:N/S:U) - consistent with the description's statement that exploitation 'does not require user interaction.' However, no EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no evidence this flaw is being exploited or that reliable exploit code exists; exploitation status is 'no public exploit identified at time of analysis.' The signals are not conflicting but they ARE thin: a high-CVSS integrity flaw from a credible source (Adobe PSIRT) with no corroborating exploitation telemetry. The improper-certificate-validation nature (CWE-295) typically requires the attacker to occupy or influence the communication path (e.g., present a forged/invalid certificate the client wrongly accepts), which the raw AV:N/AC:L metrics may understate - treat the 'unauthenticated network' framing cautiously and verify the exact trust-validation path with Adobe. Net assessment: a legitimate patch-worthy High-severity integrity issue, but absent EPSS/KEV/POC it is not demonstrably an active, widespread emergency - prioritize based on whether Content Credentials SDK is in your trust-sensitive pipeline.

An attacker positioned to supply or tamper with certificate material presents a forged or improperly-issued certificate that the CAI Content Credentials SDK fails to validate correctly, causing the SDK to accept illegitimate signing/trust material. Leveraging this, the attacker bypasses the intended security control and obtains unauthorized write access - for example injecting or altering content-provenance data that should be cryptographically protected. No public exploit code was identified at the time of analysis, and no user interaction is required.