CVE-2026-95633: 
NixOS vulnerability analysis and mitigation

CVE-2026-95633 is an Improper Verification of Cryptographic Signature vulnerability (CWE-347) affecting Adobe's CAI Content Credentials ecosystem, including the Content Credentials Rust SDK, C2PA Tool, and Content Credentials JS SDK. The vulnerability allows unauthenticated remote attackers to bypass cryptographic signature verification controls and gain unauthorized write access to content credentials without any user interaction. Affected versions include Content Credentials Rust SDK up to and including c2pa-v0.90.15, C2PA Tool up to and including c2patool-v0.27.15, and Content Credentials JS SDK up to and including @contentauth/c2pa-web@0.13.4. The vulnerability was published on October 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Adobe Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature), meaning the affected components either fail to verify or incorrectly verify cryptographic signatures attached to content credentials data. The attack vector is network-based with low complexity, requiring no privileges and no user interaction, making it straightforward for a remote attacker to exploit. An attacker can craft or manipulate content credential payloads such that the signature verification step is bypassed, enabling unauthorized write access to credential metadata. This vulnerability is associated with CAPEC-475 (Signature Spoofing by Improper Validation), where an attacker submits data with a forged or absent signature that the system incorrectly accepts as valid (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an unauthenticated network attacker to bypass the cryptographic signature verification that underpins the integrity of Adobe's Content Credentials (C2PA) ecosystem, enabling unauthorized write access to content credentials. The primary impact is on integrity — attackers could inject malicious or falsified content credentials, undermining the authenticity guarantees that the C2PA standard is designed to provide for digital media. There is no direct confidentiality or availability impact, but the ability to forge or tamper with content provenance metadata could enable disinformation campaigns or undermine trust in digitally signed media assets (GitHub Advisory, Adobe Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.459%, placing it in the 38th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements do, however, lower the barrier for potential future exploitation.

1. Reconnaissance: Identify applications or services that use Adobe's Content Credentials components (c2pa Rust SDK, c2patool, or @contentauth/c2pa-web JS SDK) in versions at or below the affected thresholds.
2. Craft malicious credential payload: Construct a C2PA content credential manifest with forged, absent, or malformed cryptographic signature data that the vulnerable library will fail to properly reject.
3. Submit payload: Deliver the crafted credential payload to the target application or service via the network — no authentication or user interaction is required.
4. Bypass signature verification: The vulnerable component incorrectly validates (or skips validation of) the cryptographic signature, accepting the malicious credential as legitimate.
5. Achieve unauthorized write access: The attacker's forged content credentials are written or accepted by the system, allowing injection of falsified provenance or authenticity metadata into digital content (GitHub Advisory, Adobe Advisory).

• Network: Unexpected or anomalous POST/PUT requests submitting C2PA manifest or credential data to services using the affected SDKs, particularly from untrusted or external IP addresses.
• Logs: Application logs showing successful credential write operations originating from unauthenticated or unexpected sources; errors or warnings related to signature validation being skipped or returning unexpected results in c2pa library logs.
• File System: Presence of C2PA manifest files with missing, empty, or structurally anomalous signature fields; unexpected modification timestamps on credential or manifest files.
• Process: Unusual invocations of c2patool from non-standard users or scripts, particularly with flags that bypass or skip signature verification steps.

Adobe has released patched versions for all three affected components: Content Credentials Rust SDK v0.91.1 (fixing versions ≤ c2pa-v0.90.15), C2PA Tool v0.28.1 (fixing versions ≤ c2patool-v0.27.15), and Content Credentials JS SDK @contentauth/c2pa-web@0.15.3 (fixing versions ≤ 0.13.4). Organizations should update all affected components to the patched versions as the primary remediation. As an additional defense-in-depth measure, implement input validation and enforce cryptographic signature verification procedures at the application layer to ensure only legitimately signed credentials are accepted (Adobe Advisory, GitHub Advisory).