Adobe CAI Content Credentials Improper Cert Validation Bypass
CVE-2026-48437 Published on August 11, 2026
CAI Content Credentials | Improper Certificate Validation (CWE-295)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Vulnerability Analysis
CVE-2026-48437 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Affected Versions
Adobe Content Credentials Rust SDK:- Before and including c2pa-v0.90.5 is affected.
- Version c2pa-v0.90.6 is unaffected.
- Before and including c2patool-v0.27.5 is affected.
- Version c2patool-v0.27.6 is unaffected.
- Before and including @contentauth/c2pa-web@0.12.0 is affected.
- Version @contentauth/c2pa-web@0.12.1 is unaffected.