{"id":"CVE-2026-113572","kind":"vulnerability","aliases":["CVE-2026-113572"],"related":[],"title":"CAI Content Credentials: weak cryptography lets attackers bypass security and write","description":"CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.","summary":"CAI Content Credentials uses a broken or risky cryptographic algorithm, which allows a security feature bypass. An attacker who meets conditions outside their control could gain unauthorized write access.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CAI Content Credentials","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["content-credentials","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:21+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","triaged_at":"2026-11-10T22:30:33+00:00","updated_at":"2026-11-10T22:30:33+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T22:30:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CAI Content Credentials: weak cryptography lets attackers bypass security and write","impact":"medium","summary":"CAI Content Credentials uses a broken or risky cryptographic algorithm, which allows a security feature bypass. An attacker who meets conditions outside their control could gain unauthorized write access.","audience":"businesses","category":"other","nicknames":[],"who_cares":["content-credentials"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker bypasses security checks and gains unauthorized write access","analyst_note":"Find affected versions, fixed release and exposure conditions in the NVD entry and the vendor advisory for CVE-2026-113572.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4583,"output_tokens":384,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113572':14A,17A '-2026':13A,16A 'access':52B,91C 'affect':57C 'algorithm':33B,67C 'allow':35B 'attack':7A,41B,78C,98C 'beyond':96C 'broken':29B,63C 'bypass':8A,39B,76C,84C 'cai':1A,18A,24B,53C 'condit':44B,95C 'content':2A,19A,22B,25B,54C 'content-credenti':21B 'control':47B,100C 'could':48B,70C,79C 'credenti':3A,23B,26B,55C 'credentials':20A 'cryptograph':32B,66C 'cryptographi':5A 'cve':12A,15A 'depend':93C 'exploit':92C,101C 'featur':38B,75C 'gain':49B,88C 'interact':109C 'issu':104C 'let':6A 'leverag':80C 'measur':86C 'meet':43B 'outsid':45B 'requir':107C 'result':71C 'riski':31B,65C 'secur':9A,37B,74C,85C 'unauthor':50B,89C 'use':27B,60C 'user':108C 'vulner':68C,82C 'weak':4A 'write':11A,51B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["caicontentcredentials","contentcredentials"],"ptokens":["cai","content","credentials"],"labels":["contentcredentials","medium","other","vendor"],"campaign_type":null,"search_a":"'-113572':14A,17A '-2026':13A,16A 'attack':7A 'bypass':8A 'cai':1A,18A 'content':2A,19A 'credenti':3A 'credentials':20A 'cryptographi':5A 'cve':12A,15A 'let':6A 'secur':9A 'weak':4A 'write':11A","search_b":"'access':52B 'algorithm':33B 'allow':35B 'attack':41B 'broken':29B 'bypass':39B 'cai':24B 'condit':44B 'content':22B,25B 'content-credenti':21B 'control':47B 'could':48B 'credenti':23B,26B 'cryptograph':32B 'featur':38B 'gain':49B 'meet':43B 'outsid':45B 'riski':31B 'secur':37B 'unauthor':50B 'use':27B 'write':51B","search_c":"'access':91C 'affect':57C 'algorithm':67C 'attack':78C,98C 'beyond':96C 'broken':63C 'bypass':76C,84C 'cai':53C 'condit':95C 'content':54C 'control':100C 'could':70C,79C 'credenti':55C 'cryptograph':66C 'depend':93C 'exploit':92C,101C 'featur':75C 'gain':88C 'interact':109C 'issu':104C 'leverag':80C 'measur':86C 'requir':107C 'result':71C 'riski':65C 'secur':74C,85C 'unauthor':89C 'use':60C 'user':108C 'vulner':68C,82C 'write':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113572","severity":null,"published_at":"2026-11-10T22:18:21+00:00","modified_at":"2026-11-10T22:18:21+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","fetched_at":"2026-11-10T22:27:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}