What is the CVSS score of EUVD-2026-56277?

EUVD-2026-56277 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.7%.

Content Credentials SDK EUVD-2026-56277

| CVE-2026-48436 MEDIUM

Improper Input Validation (CWE-20)

2026-08-11 psirt@adobe.com

GHSA-cpcp-hwrj-fvw3

Authentication Bypass Adobe C2Pa C2Pa Web C2Patool

6.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted URL, no privileges needed, user interaction required, integrity-only impact with no confidentiality or availability effect - matches provided vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:35 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

AnalysisAI

Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote unauthenticated attacker to bypass integrity verification and gain unauthorized write access to C2PA-signed content metadata. All three SDK components prior to their respective patch releases are affected, and exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page. No public exploit code or active exploitation has been identified at time of analysis, though the write-impact on content authenticity signals carries meaningful trust implications for downstream consumers.

Technical ContextAI

The Content Credentials ecosystem implements the Coalition for Content Provenance and Authenticity (C2PA) specification, which embeds cryptographically signed provenance manifests into media assets. The affected components - @contentauth/c2pa-web (JavaScript/WebAssembly), the c2pa Rust crate, and c2patool - all share responsibility for validating manifest structures before accepting or processing them. CWE-20 (Improper Input Validation) at this layer means crafted manifest or URL input is not sufficiently sanitized or rejected, allowing an attacker to bypass the trust assertions that Content Credentials are designed to enforce. Because write access is the stated impact, the bypass likely permits forging or altering manifest data that the SDK would otherwise reject as invalid or unauthorized.

RemediationAI

The primary fix is to upgrade all in-use Content Credentials components to their patched releases: @contentauth/c2pa-web@0.12.1 for the JS SDK (update via npm or yarn), c2pa-v0.90.6 for the Rust crate (update Cargo.toml dependency), and c2patool-v0.27.6 for the command-line tool. Full guidance is available in Adobe security advisory APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. Where immediate patching is not feasible, organizations can reduce exposure by restricting the contexts in which Content Credentials validation is triggered from user-supplied URLs - for example, disabling or gating any web-facing workflows that accept arbitrary C2PA manifest URLs from untrusted sources. This trade-off limits functionality but removes the UI:R attack surface until the patch can be deployed.