CVE-2026-104345

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
AdobeContent Credentials Rust SDK<= c2pa-v0.90.15
AdobeC2PA Tool<= c2patool-v0.27.15
AdobeContent Credentials JS SDK<= @contentauth/c2pa-web@0.13.4

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1043467.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-1043477.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-1043487.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-1043557.0A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiCVE-2026-1043565.9PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic randCVE-2026-1043643.3IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input valCVE-2026-1043805.3Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HCVE-2026-1043857.5Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.CVE-2026-1043866.5Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.ThiCVE-2026-1043877.2Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.CVE-2026-1043885.3Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issuCVE-2026-1043898.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Inject