CVE-2026-48295 - Vulnerability Details - OpenCVE

CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Adobe	Content Credentials Command-line Tool Content Credentials Js Sdk Content Credentials Rust Sdk

No data.

No data.

References

Link	Providers
https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html

History

Sun, 02 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe content Credentials Command-line Tool Adobe content Credentials Js Sdk Adobe content Credentials Rust Sdk
Vendors & Products		Adobe Adobe content Credentials Command-line Tool Adobe content Credentials Js Sdk Adobe content Credentials Rust Sdk

Wed, 15 Jul 2026 00:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 14 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction.
Title		CAI Content Credentials \| Insufficiently Protected Credentials (CWE-522)
Weaknesses		CWE-522
References		https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: adobe

Published: 2026-07-14T21:33:01.777Z

Updated: 2026-07-14T23:39:11.628Z

Reserved: 2026-05-21T15:28:38.135Z

Link: CVE-2026-48295

Vulnrichment

Updated: 2026-07-14T23:33:51.730Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48295", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-05-21T15:28:38.135Z", "datePublished": "2026-07-14T21:33:01.777Z", "dateUpdated": "2026-07-14T23:39:11.628Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Content Credentials Rust SDK", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "c2pa-v0.84.0", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "c2pa-v0.85.2", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "Content Credentials Command-Line Tool", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "c2patool-v0.16.5", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "c2patool-v0.26.65", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "Content Credentials JS SDK", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "@contentauth/c2pa-web@0.7.0", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "@contentauth/c2pa-web@0.9.0", "versionType": "custom"}]}], "datePublic": "2026-07-14T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "NONE", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "Insufficiently Protected Credentials (CWE-522)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-07-14T21:42:10.803Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html"}], "source": {"discovery": "EXTERNAL"}, "title": "CAI Content Credentials | Insufficiently Protected Credentials (CWE-522)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T23:32:32.211641Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T23:39:11.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T23:32:32.211641Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T23:33:51.730Z"}}], "cna": {"title": "CAI Content Credentials | Insufficiently Protected Credentials (CWE-522)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 7.5, "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "NONE", "environmentalScore": 7.5, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Content Credentials Rust SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "c2pa-v0.84.0"}, {"status": "unaffected", "version": "c2pa-v0.85.2", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "Adobe", "product": "Content Credentials Command-Line Tool", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "c2patool-v0.16.5"}, {"status": "unaffected", "version": "c2patool-v0.26.65", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "Adobe", "product": "Content Credentials JS SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "@contentauth/c2pa-web@0.7.0"}, {"status": "unaffected", "version": "@contentauth/c2pa-web@0.9.0", "versionType": "custom"}], "defaultStatus": "affected"}], "datePublic": "2026-07-14T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials (CWE-522)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-07-14T21:42:10.803Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48295", "state": "PUBLISHED", "dateUpdated": "2026-07-14T23:39:11.628Z", "dateReserved": "2026-05-21T15:28:38.135Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-07-14T21:33:01.777Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}