What is the CVSS score of CVE-2026-71390?

CVE-2026-71390 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Content Credentials SDK CVE-2026-71390

EUVD-2026-56281 MEDIUM

Improper Input Validation (CWE-20)

2026-08-11 psirt@adobe.com

GHSA-9gf7-jjqp-ph56

Authentication Bypass Adobe C2Pa C2Pa Web C2Patool

4.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

AV:L confirmed by description; PR:L assessed because placing attacker-controlled files on a local system implies at least limited local user access, making PR:N implausible for a local vector.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:02 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper input validation in Adobe's Content Credentials ecosystem (Rust SDK, JS SDK, and CLI tool) allows local attackers to bypass C2PA content authenticity security controls and gain unauthorized limited write access to credential metadata. Affected are c2pa-v0.90.5 and earlier, @contentauth/c2pa-web@0.12.0 and earlier, and c2patool-v0.27.5 and earlier. No user interaction is required, but the local attack vector (AV:L) and SSVC automation rating of 'no' constrain realistic exploitation to targeted scenarios rather than mass exploitation.

Technical ContextAI

The Coalition for Content Provenance and Authenticity (C2PA) standard underpins Adobe's Content Credentials technology, which embeds cryptographically signed provenance metadata into media files to assert authenticity and detect tampering. The Rust SDK (c2pa-rs), JavaScript/WebAssembly SDK (@contentauth/c2pa-web), and CLI tool (c2patool) all share parsing logic for C2PA manifests. CWE-20 (Improper Input Validation) indicates that crafted or malformed manifest input is not sufficiently sanitized or bounds-checked before processing, allowing an attacker to influence the write path for credential metadata in ways the security model is intended to prevent. This undermines the integrity guarantee that is the entire purpose of the C2PA standard.

RemediationAI

Upgrade to the vendor-released patched versions: Rust SDK to c2pa-v0.90.6, JavaScript SDK to @contentauth/c2pa-web@0.12.1, and CLI tool to c2patool-v0.27.6, as documented in Adobe advisory APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. If immediate upgrade is not possible, the most effective compensating control is to restrict which input files and sources are processed by the SDK - treating all externally sourced C2PA manifests as untrusted and validating them through a separate integrity check layer before passing to the vulnerable SDK. Avoid processing C2PA manifests from untrusted or user-supplied sources until patched. Because the attack requires local file access or control over inputs, network-perimeter controls provide no mitigation value here.