Back to overview

CVE-2026-48290

HIGH
8.2
CVSS 3.1
Description
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Metadata

CVE ID
CVE-2026-48290
State
PUBLISHED
Assigner
adobe
Reserved
2026-05-21 15:28 UTC
Published
2026-07-14 21:33 UTC
Last updated
2026-07-14 23:39 UTC
Primary CWE
CWE-918
Server-Side Request Forgery (SSRF) (CWE-918)
Vendor / Product
Adobe / Content Credentials Rust SDK
Sources
cve.org  ·  NVD

Severity & Metrics

8.2 HIGH CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (3)
VendorProductPlatformVersions
Adobe Content Credentials Command-Line Tool — 0 ≤ c2patool-v0.16.5, c2patool-v0.26.65
Adobe Content Credentials JS SDK — 0 ≤ @contentauth/c2pa-web@0.7.0, @contentauth/c2pa-web@0.9.0
Adobe Content Credentials Rust SDK — 0 ≤ c2pa-v0.84.0, c2pa-v0.85.2
Weakness (CWE)
CWESourceDescription
CWE-918 cna Server-Side Request Forgery (SSRF) (CWE-918)
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.2 HIGH 3.1 cna CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References (1)
Back to overview