Content Credentials Rust SDK vulnerability

What happened

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Affected versions

Content Credentials Rust SDK: 0 through c2pa-v0.90.15 (custom); 0 through c2patool-v0.27.15 (custom); 0 through @contentauth/c2pa-web@0.13.4 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.