Adobe Content Credentials: Improper signature verification allows security bypass
Summary
Adobe's Content Credentials Rust SDK (c2pa) and C2PA Tool (c2patool) do not properly verify cryptographic signatures in C2PA manifests. An attacker who can supply crafted signed content to an affected application may bypass security checks and gain unauthorized write access. Exploitation depends on conditions outside the attacker's control, and no user interaction is required.
Affected
- Content Credentials Rust SDK (c2pa): version c2pa-v0.91.10 and earlier
- C2PA Tool (c2patool): version c2patool-v0.28.5 and earlier
Fixed in
- Content Credentials Rust SDK: c2pa-v0.91.11
- C2PA Tool: c2patool-v0.28.6
Workaround
Unknown. No vendor workaround was identified. Updating to the fixed versions is the recommended remedy.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- No public proof of concept was identified for this CVE, but this status is unknown rather than confirmed absent.
Our recommendation
- Inventory all uses of the Rust SDK or C2PA Tool, including CI/CD images and third-party products that bundle them.
- Update to c2pa-v0.91.11 or c2patool-v0.28.6 or later.
- If content provenance decisions made with vulnerable builds matter for compliance or legal evidence, re-verify them after updating.
- Priority is low for most SMEs unless they build or ship software that embeds these libraries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-184 www.adobe.com
- CVE Record CVE-2026-123261 www.cve.org
- HKCERT Adobe Monthly Security Update November 2026 www.hkcert.org
- VulDB CVE-2026-123261 vuldb.com
- Strix CVE-2026-123261 www.strix.ai
- OffSeq Radar CVE-2026-123261 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:58.
Original description (NVD)
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.