CVE-2026-48378: CAI Content Credentials | Improper Input Validation (CWE-20)
Published Oct 13, 2026
·Updated
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
Affected Software
4 affected components
CAI Content Credentials
Adobe C2pa Rust<0.91.1
Adobe C2pa-web Node.js<0.15.3
Adobe C2patool<0.28.1
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·09:27 PM
Data Sourced
via MITRE·09:27 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-95634
- CVE-2026-100124
- CVE-2026-100123
- CVE-2026-104345
- CVE-2026-100122
- CVE-2026-100121
- CVE-2026-100120
- CVE-2026-100119
- CVE-2026-100118
- CVE-2026-100117
- CVE-2026-100115
- CVE-2026-100114
- CVE-2026-100139
- CVE-2026-100138
- CVE-2026-100137
- CVE-2026-106627
- CVE-2026-95632
- CVE-2026-100113
- CVE-2026-100136
- CVE-2026-100135
- CVE-2026-103296
- CVE-2026-105902
- CVE-2026-100125
- CVE-2026-100116
- CVE-2026-103294
- CVE-2026-103820
- CVE-2026-102502
- CVE-2026-102501
- CVE-2026-48377
Frequently Asked Questions
1
Can this be exploited without credentials or user interaction?
Yes. The CVSS vector indicates no privileges are required and no user interaction is needed.
2
Does an attacker need local access to attempt exploitation?
No. The CVSS attack vector is network-based, indicating the issue can be targeted over the network.
3
What access could exploitation provide?
Successful exploitation could bypass security measures and provide unauthorized limited write access. The reported impact is limited to integrity; no confidentiality or availability impact is specified.