EUVD-2026-56559
GHSA-7w8g-9r55-5fvq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Malicious URL delivery indicates network attack vector (AV:N), not local; no privileges required; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
AnalysisAI
Certificate validation bypass in Adobe's Content Credentials SDK undermines the C2PA provenance chain across three SDK variants - JavaScript/WASM (@contentauth/c2pa-web through 0.12.0), Rust (c2pa through v0.90.5), and CLI (c2patool through v0.27.5) - allowing an attacker-controlled certificate to be accepted as legitimate when a victim visits a malicious URL or interacts with a compromised web page. Successful exploitation grants unauthorized write access to content credentials, enabling an attacker to forge provenance metadata and defeat the product's core integrity guarantee. No public exploit has been identified at time of analysis; vendor-released patches exist for all three affected SDK variants.
Technical ContextAI
The C2PA (Coalition for Content Provenance and Authenticity) standard, implemented here by Adobe/ContentAuth as the Content Credentials SDK, uses X.509 certificate chains embedded in media manifests to assert the origin and authenticity of digital content. CWE-295 (Improper Certificate Validation) describes a class of root causes where certificate properties - such as chain of trust, revocation status, Extended Key Usage, or signature correctness - are insufficiently checked, allowing a malformed or attacker-controlled certificate to satisfy the validator. In this context, the flaw allows a crafted C2PA manifest carrying an invalid certificate to pass the SDK's validation logic. The vulnerability spans all three SDK surfaces: the JavaScript/WASM browser-side library (@contentauth/c2pa-web), the underlying Rust core library (c2pa), and the command-line processing tool (c2patool), indicating the root cause likely resides in shared validation logic propagated to all consumers.
RemediationAI
Upgrade all in-use SDK components to their patched versions: update @contentauth/c2pa-web to 0.12.1 via npm (npm update @contentauth/c2pa-web or pin 0.12.1 in package.json), update the c2pa Rust crate to v0.90.6 in Cargo.toml and run cargo update, and replace c2patool binaries with the v0.27.6 release. Full details are available in Adobe's advisory at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. If immediate patching is not possible, the most actionable compensating control is to disable or sandbox any processing of externally-sourced C2PA manifests until the patch is applied - this eliminates the attack surface at the cost of disabling provenance verification for untrusted content. Do not treat unvalidated C2PA certificates as authoritative for any trust decision while running vulnerable versions. Applications deployed in contexts where C2PA is purely informational (display only, no enforcement) carry lower residual risk than those using SDK output to gate access or certify authenticity.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today