Adobe Content Credentials SDK: Improper signature verification allows security bypass
Summary
Adobe's Content Credentials Rust SDK (up to c2pa-v0.91.10) and C2PA Tool (up to c2patool-v0.28.5) contain an improper verification of cryptographic signatures (CWE-347). An attacker may be able to bypass security checks and gain unauthorized write access. Exploitation requires conditions outside the attacker's control, and no user interaction is needed. Adobe is not aware of any exploits in the wild.
Affected
- Content Credentials Rust SDK: c2pa-v0.91.10 and earlier
- C2PA Tool: c2patool-v0.28.5 and earlier
- All platforms
Fixed in
- Content Credentials Rust SDK: c2pa-v0.91.11
- C2PA Tool: c2patool-v0.28.6
- Per the CVE record; please confirm against Adobe bulletin APSB26-184.
Workaround
Unknown. Adobe documents no workaround for this CVE.
Exploitation
- Adobe is not aware of any exploits in the wild.
- OffSeq lists the issue as not known to be exploited.
- No public proof of concept found in the research performed.
Our recommendation
- Identify systems that embed the Rust SDK (crate c2pa / content-credentials-rust-sdk) or run c2patool, especially where they decide whether media or provenance data is trustworthy.
- Update to c2pa-v0.91.11 or c2patool-v0.28.6 in the next regular maintenance cycle, sooner if the SDK is part of customer-facing software.
- Rebuild and redeploy internal tools against the fixed version.
- Until patched, do not rely on signature verification results from unpatched builds for trust decisions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-123262 www.cve.org
- Adobe Security Bulletin APSB26-184 www.adobe.com
- OffSeq exploitation status radar.offseq.com
- HKCERT Adobe monthly update November 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:58.
Original description (NVD)
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.