CVE-2026-103294

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:c2pa::::::rust::*
	cpe:2.3:a:adobe:c2pa-web::::::node.js::*
	cpe:2.3:a:adobe:c2patool::::::::

History

14 Oct 2026, 18:57

Type	Values Removed	Values Added
First Time		Adobe c2patool Adobe Adobe c2pa-web Adobe c2pa
CPE		cpe:2.3:a:adobe:c2pa-web::::::node.js::* cpe:2.3:a:adobe:c2pa::::::rust::* cpe:2.3:a:adobe:c2patool::::::::
References	~~() https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html -~~	() https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html - Vendor Advisory

13 Oct 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-13 22:17

Updated : 2026-10-17 02:17

NVD link : CVE-2026-103294

Mitre link : CVE-2026-103294

CVE.ORG link : CVE-2026-103294

JSON object : View

Products Affected

adobe

c2pa-web
c2patool
c2pa

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-103294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103294", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-17T00:53:01.663543Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Content Credentials Rust SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "c2pa-v0.90.15"}, {"status": "unaffected", "version": "c2pa-v0.91.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "C2PA Tool", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "c2patool-v0.27.15"}, {"status": "unaffected", "version": "v0.28.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Content Credentials JS SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "@contentauth/c2pa-web@0.13.4"}, {"status": "unaffected", "version": "@contentauth/c2pa-web@0.15.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-13T22:17:23.820", "references": [{"url": "https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}], "lastModified": "2026-10-17T02:17:09.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "8A2F7300-DE4A-4D6D-8249-82DF7E783C8F", "versionEndExcluding": "0.91.1"}, {"criteria": "cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E6950BAC-98E6-4B41-A4CB-D8EF54AD7866", "versionEndExcluding": "0.15.3"}, {"criteria": "cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "874FDC5D-2A5E-40A8-B7E8-EF248F42F7FF", "versionEndExcluding": "0.28.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}