CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Problem type

Improper Input Validation (CWE-20)

Affected products

Adobe

Content Credentials Rust SDK

<= c2pa-v0.90.15 - AFFECTED

c2pa-v0.91.1 - UNAFFECTED

C2PA Tool

<= c2patool-v0.27.15 - AFFECTED

v0.28.1 - UNAFFECTED

Content Credentials JS SDK

<= @contentauth/c2pa-web@0.13.4 - AFFECTED

@contentauth/c2pa-web@0.15.3 - UNAFFECTED

References

adobe.com

https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html

vendor-advisory

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-100119

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-100119",
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "dateUpdated": "2026-10-13T21:27:46.102Z",
    "dateReserved": "2026-09-25T11:19:19.065Z",
    "datePublished": "2026-10-13T21:27:46.102Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe",
        "dateUpdated": "2026-10-13T21:27:46.102Z"
      },
      "datePublic": "2026-10-13T17:00:00.000Z",
      "title": "CAI Content Credentials | Improper Input Validation (CWE-20)",
      "descriptions": [
        {
          "lang": "en",
          "value": "CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction."
        }
      ],
      "affected": [
        {
          "vendor": "Adobe",
          "product": "Content Credentials Rust SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "c2pa-v0.90.15"
            },
            {
              "version": "c2pa-v0.91.1",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Adobe",
          "product": "C2PA Tool",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "c2patool-v0.27.15"
            },
            {
              "version": "v0.28.1",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Adobe",
          "product": "Content Credentials JS SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "@contentauth/c2pa-web@0.13.4"
            },
            {
              "version": "@contentauth/c2pa-web@0.15.3",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Input Validation (CWE-20)",
              "cweId": "CWE-20",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html",
          "tags": [
            "vendor-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "availabilityRequirement": "NOT_DEFINED",
            "modifiedAttackVector": "NETWORK",
            "modifiedAttackComplexity": "LOW",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedUserInteraction": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedAvailabilityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH"
          }
        }
      ]
    }
  }
}