All vulnerabilities
CVE-2026-100123

CAI Content Credentials | Improper Certificate Validation (CWE-295)

Adobe Content Credentials Rust SDK
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 17 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Text from CVE List

Affected versions 6

  • Content Credentials Rust SDKaffected: all versions through c2pa-v0.90.15CVE List
  • Content Credentials Rust SDKunaffected: c2pa-v0.91.1CVE List
  • C2PA Toolaffected: all versions through c2patool-v0.27.15CVE List
  • C2PA Toolunaffected: v0.28.1CVE List
  • Content Credentials JS SDKaffected: all versions through @contentauth/c2pa-web@0.13.4CVE List
  • Content Credentials JS SDKunaffected: @contentauth/c2pa-web@0.15.3CVE List

References 1