CVE-2026-100118: CAI Content Credentials | Improper Certificate Validation (CWE-295)

Q: Does an attacker need an authenticated account to exploit this issue?

No. The vulnerability is rated with no privileges required, so an attacker does not need an existing authenticated account.

Q: Can this be exploited remotely, and how difficult is exploitation expected to be?

The attack vector is network-based and attack complexity is low. User interaction is not required.

Q: What security impact is indicated by the severity metrics?

The issue has high integrity impact, consistent with unauthorized write access or bypass of security controls. No confidentiality or availability impact is indicated.

Published Oct 13, 2026

Updated

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Affected Software

4 affected components

CAI Content Credentials

Adobe C2pa Rust<0.91.1

Adobe C2pa-web Node.js<0.15.3

Adobe C2patool<0.28.1

Event History

Oct 13, 2026

CVE Published

12:00 AM

Data Sourced

12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·09:27 PM

Data Sourced

via MITRE·09:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

APSB26-163

Frequently Asked Questions

Does an attacker need an authenticated account to exploit this issue?

No. The vulnerability is rated with no privileges required, so an attacker does not need an existing authenticated account.

Can this be exploited remotely, and how difficult is exploitation expected to be?

The attack vector is network-based and attack complexity is low. User interaction is not required.

What security impact is indicated by the severity metrics?

The issue has high integrity impact, consistent with unauthorized write access or bypass of security controls. No confidentiality or availability impact is indicated.

CVE-2026-100118: CAI Content Credentials | Improper Certificate Validation (CWE-295)

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Does an attacker need an authenticated account to exploit this issue?

Can this be exploited remotely, and how difficult is exploitation expected to be?

What security impact is indicated by the severity metrics?

Company

Resources

Contact