Adobe Content Credentials SDK: Improper certificate validation
Summary
Adobe's Content Credentials Rust SDK (up to c2pa-v0.91.10) and C2PA Tool (up to c2patool-v0.28.5) do not properly validate certificates. A local attacker with low privileges and no user interaction could bypass security checks and modify integrity-relevant data, but exploitation requires high complexity and conditions outside the attacker's control. The vulnerability is rated medium (CVSS 5.1) and no exploitation in the wild is known.
Affected
- Content Credentials Rust SDK: c2pa-v0.91.10 and earlier
- C2PA Tool: c2patool-v0.28.5 and earlier
- All platforms
Fixed in
- Content Credentials Rust SDK: c2pa-v0.91.11
- C2PA Tool: c2patool-v0.28.6
- Fixed versions taken from the CVE record; confirm against advisory APSB26-184.
Workaround
Unknown. No vendor workaround is documented. Restrict write access to affected signing or verification pipelines until patched.
Exploitation
- Adobe is not aware of any exploits in the wild.
- Not listed in CISA KEV.
- No public proof of concept found at the time of research.
Our recommendation
- Identify systems and build pipelines that use the Content Credentials Rust SDK or C2PA Tool, including bundled copies.
- Update to c2pa-v0.91.11 or c2patool-v0.28.6 in the next maintenance cycle, or sooner if these components ship in your own software.
- Do not rely on verification results for trust decisions until patched.
- Monitor for public proof of concept code and vendor updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-184 www.adobe.com
- CVE Record CVE-2026-122098 www.cve.org
- OpenCVE CVE-2026-122098 app.opencve.io
- OffSeq threat radar CVE-2026-122098 radar.offseq.com
- Strix CVE-2026-122098 www.strix.ai
- HKCERT Adobe security update November 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:06.
Original description (NVD)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.