EUVD-2026-100722
GHSA-338g-qwhq-hjph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain man-in-the-middle network position
-
DeliveryPresent forged/invalid certificate
-
ExploitSDK fails certificate validation
-
ExecutionImpersonate trusted endpoint
-
ImpactGain unauthorized write access / tamper provenance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Exploitation requires the attacker to intercept a TLS/certificate-validated connection used by the CAI Content Credentials SDK (an attacker-in-the-middle position on the network path) and supply a forged or invalid certificate that the SDK accepts due to improper validation. The CVSS vector states PR:N and UI:N, so no credentials or user interaction are needed once the MITM position is established; the primary limiting factor is obtaining that network interception position, which constrains opportunistic/remote mass exploitation to adversaries who already control or can manipulate the network path. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5 HIGH) presents this as a remotely and unauthenticatedly exploitable integrity-only flaw. However, the underlying weakness is CWE-295 (Improper Certificate Validation), which realistically requires an attacker-in-the-middle position to present a forged or invalid certificate - this typically raises attack complexity above the AC:L stated in the input, so the raw score likely overstates ease of exploitation (see assessed vector). No EPSS score, CISA KEV listing, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. Net: this is a credible integrity-bypass issue in an Adobe-maintained SDK, but absent KEV/EPSS/POC signals and given the MITM precondition typical of cert-validation flaws, it reads as a patch-in-normal-cycle item rather than an emergency, unless the affected SDK is deployed in a high-value content-provenance trust path. EPSS/KEV data is MISSING and should be checked before final prioritization. |
| Exploit ScenarioDerived | An attacker positioned on the network path between a client using the CAI Content Credentials SDK and a remote endpoint presents a forged or otherwise invalid TLS certificate that the SDK fails to properly validate. Because validation is bypassed, the attacker impersonates the trusted endpoint and obtains unauthorized write access to content credential data, undermining the integrity/provenance guarantees the SDK exists to provide. No public exploit code was identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Improper certificate validation in the CAI Content Credentials SDK enables a network-positioned attacker who can intercept TLS connections to bypass security features and gain unauthorized write access. Exploitation requires a man-in-the-middle (MITM) position to supply a forged or invalid certificate that the SDK accepts; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, and although the input CVSS 7.5 vector lists AC:L, our assessment raises attack complexity because the MITM prerequisite limits opportunistic mass exploitation. No user interaction or credentials are needed once the MITM position is obtained. No public exploit identified at time of analysis.
RemediationAI
Apply the vendor-released patch referenced in Adobe advisory APSB26-163; the exact fixed version is not enumerated in the provided data, so consult the bulletin for the specific update (patch available per vendor advisory). Until patched, mitigate the MITM prerequisite by enforcing strict certificate validation or certificate pinning if the SDK configuration allows it, and by restricting network paths or monitoring for TLS interception. Trade-offs: certificate pinning can break legitimate TLS inspection proxies and require careful key management; network restrictions may disrupt legitimate integrations. Disabling the affected SDK feature (if feasible) would eliminate exposure but may remove content credential functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-295 (Improper Certificate Validation) is the root cause. The CAI Content Credentials SDK uses TLS/certificate validation as a core security mechanism, likely for verifying the authenticity of content credentials or securing API communications. Because the SDK does not properly validate the server certificate during TLS handshakes, an attacker in a MITM position can present a self-signed, expired, or otherwise invalid certificate and the SDK will accept it, bypassing authentication and integrity protections and enabling unauthorized write access. The vulnerability is in the Content Credentials SDK from Adobe (reference advisory APSB26-163). No CPE strings were provided in the input data; the affected component is the SDK itself. The CVSS vector indicates network attack vector and no privileges or user interaction, but the assessed attack complexity is high (AC:H) due to the MITM requirement.
Know when C2Pa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Improper certificate validation requires an attacker-in-the-middle position to present a forged cert, so AC:H; no auth needed (PR:N); impact is integrity-only (I:H, C:N, A:N).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Executive ViewAI
The CAI Content Credentials SDK has a trust-validation weakness that could allow a network-positioned attacker to forge or bypass security checks, resulting in unauthorized write access to credential data. Organizations using the SDK should care because this could undermine the integrity of content authenticity claims, affect downstream business processes, and damage stakeholder trust. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so mitigation depends on compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict SDK use to trusted networks, enforce strict TLS certificate validation and certificate pinning at the network and application layers where feasible, segment affected systems, and monitor for anomalous write activity to credential stores.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote att
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resou
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaus
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated r
Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthori
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted i
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications t
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resource
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust sys
Exploit-DB