CVE-2026-48377: Adobe Content Credentials SDK improper input validation and certificate bypass

CVE-2026-48377 · Severity: medium · CVSS 5.3 · Published 2026-10-13

Adobe Content Credentials SDK, a toolkit for verifying and managing digital content authentication, contains multiple validation flaws that allow attackers to bypass security protections without user interaction. An attacker can forge credentials, trigger denial-of-service conditions, or gain unauthorized write access to protected content, undermining the integrity guarantees that these tools are designed to provide.

Technologies: Adobe C2pa, Adobe C2PA Tool, Adobe C2pa-Web, Adobe C2patool, Adobe Content Credentials JS SDK, Adobe Content Credentials Rust SDK. Vendors: Adobe.

Quick answers

Is CVE-2026-48377 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48377 being exploited in the wild.
How severe is CVE-2026-48377?
Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?
Adobe C2PA Tool c2patool-v0.27.15 and earlier; Adobe Content Credentials JS SDK @contentauth/c2pa-web@0.13.4 and earlier; Adobe Content Credentials Rust SDK c2pa-v0.90.15 and earlier.
Is there a fix for CVE-2026-48377?
Yes: fixed in Content Credentials Rust SDK c2pa-v0.91.1, C2PA Tool c2patool-v0.28.1, Content Credentials JS SDK @contentauth/c2pa-web@0.15.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48377 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48377?
Check whether you run Adobe C2pa, Adobe C2PA Tool, Adobe C2pa-Web or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Content Credentials Rust SDK c2pa-v0.91.1, C2PA Tool c2patool-v0.28.1, Content Credentials JS SDK @contentauth/c2pa-web@0.15.3

Technical details

Multiple critical flaws span improper input validation (CWE-20), certificate validation bypasses (CWE-295), cryptographic signature verification failures (CWE-347), server-side request forgery (CWE-918), and resource exhaustion (CWE-400). These vulnerabilities are network-accessible with no privilege or user interaction required, allowing remote attackers to forge credentials, bypass authentication mechanisms, manipulate content metadata, or exhaust application resources. All three SDK distributions are affected: the Rust library c2pa, the command-line tool c2patool, and the JavaScript web library.

Affected products

  • Adobe Content Credentials Rust SDK c2pa-v0.90.15 and earlier
  • Adobe C2PA Tool c2patool-v0.27.15 and earlier
  • Adobe Content Credentials JS SDK @contentauth/c2pa-web@0.13.4 and earlier

Timeline

  • 2026-10-13: disclosed: APSB26-163 published; priority 3 severity rating

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.