Executive brief
Adobe Content Credentials tools, which are used to verify the authenticity and origin of digital content, are affected by a security flaw that improperly protects sensitive credentials. An attacker could exploit this to gain unauthorized access to private information without any interaction from a user. This could undermine the trust in digital content provenance or expose sensitive data handled by the SDKs.
Technical details
Adobe Content Credentials (CAI) is vulnerable to CWE-522 (Insufficiently Protected Credentials) across its Rust SDK, JS SDK, and Command-Line Tool. The flaw allows a remote attacker to gain unauthorized read access to sensitive information due to inadequate credential protection mechanisms. The vulnerability is exploitable over the network with low complexity and requires no special privileges or user interaction. Adobe has released updates to address this issue in Rust SDK v0.85.2, CLI Tool v0.26.65, and JS SDK v0.17.0.
Affected products
- Adobe Content Credentials Rust SDK <= c2pa-v0.84.0
- Adobe Content Credentials Command-Line Tool <= c2patool-v0.16.5
- Adobe Content Credentials JS SDK <= @contentauth/c2pa-v0.16.0
Timeline
- 2026-07-14: advisory: Adobe published APSB26-80 advisory
- 2026-07-14: disclosed