CVE-2026-47922 PUBLISHED

CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)

Assigner: adobe
Reserved: 20.05.2026 Published: 11.08.2026 Updated: 11.08.2026

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS Score: 4.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Adobe
Product	Content Credentials Rust SDK
Versions	Default: affected affected from 0 to c2pa-v0.90.5 (incl.) Version c2pa-v0.90.6 is unaffected

Vendor	Adobe
Product	Content Credentials Command-Line Tool
Versions	Default: affected affected from 0 to c2patool-v0.27.5 (incl.) Version c2patool-v0.27.6 is unaffected

Vendor	Adobe
Product	Content Credentials JS SDK
Versions	Default: affected affected from 0 to @contentauth/c2pa-web@0.12.0 (incl.) Version @contentauth/c2pa-web@0.12.1 is unaffected

References

https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html

Problem Types

Server-Side Request Forgery (SSRF) (CWE-918) CWE