Executive brief
Adobe Content Credentials, a toolset used to verify the authenticity and origin of digital content, is affected by a security bypass vulnerability. An attacker could exploit this flaw to gain unauthorized write access, potentially allowing them to tamper with or forge digital provenance information. This could undermine the trust and integrity of media files that rely on these credentials to prove their source.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Adobe Content Authenticity Initiative (CAI) SDKs and command-line tools. The flaw allows an attacker to bypass security measures and gain unauthorized write access to content credentials. The vulnerability is exploitable via a local attack vector and does not require user interaction. Affected components include the Rust SDK (up to v0.84.0), the JS SDK (up to v0.20.0), and the C2PA command-line tool (up to v0.16.5). Patches have been released in newer versions of these tools.
Affected products
- Adobe Content Credentials Rust SDK <= c2pa-v0.84.0
- Adobe Content Credentials Command-Line Tool <= c2patool-v0.16.5
- Adobe Content Credentials JS SDK <= @contentauth/c2pa-js-v0.20.0
Timeline
- 2026-07-14: advisory: Adobe published APSB26-80 advisory
- 2026-07-14: disclosed