{"id":"CVE-2026-113573","kind":"vulnerability","aliases":["CVE-2026-113573"],"related":[],"title":"CAI Content Credentials: input validation flaw lets attackers bypass security checks","description":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.","summary":"CAI Content Credentials has an improper input validation flaw that can bypass a security feature. An attacker who succeeds can gain unauthorized write access, though exploitation depends on conditions outside their control.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cai-content-credentials","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:21+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","triaged_at":"2026-11-10T22:30:33+00:00","updated_at":"2026-11-10T22:30:33+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-10T22:30:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CAI Content Credentials: input validation flaw lets attackers bypass security checks","impact":"medium","summary":"CAI Content Credentials has an improper input validation flaw that can bypass a security feature. An attacker who succeeds can gain unauthorized write access, though exploitation depends on conditions outside their control.","audience":"developers","category":"package","nicknames":[],"who_cares":["cai-content-credentials"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains unauthorized write access by bypassing a security feature","analyst_note":"Find the affected versions and vendor advisory for CAI Content Credentials; the NVD entry gives no product ranges or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":4560,"output_tokens":358,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113573':14A,17A '-2026':13A,16A 'access':46B,88C 'affect':59C 'attack':8A,39B,75C,95C 'beyond':93C 'bypass':9A,34B,73C,81C 'cai':1A,19B,23B,55C 'cai-content-credenti':18B 'check':11A 'condit':51B,92C 'content':2A,20B,24B,56C 'control':54B,97C 'could':67C,76C 'credenti':3A,21B,25B,57C 'cve':12A,15A 'depend':49B,90C 'exploit':48B,89C,98C 'featur':37B,72C 'flaw':6A,31B 'gain':43B,85C 'improp':28B,62C 'input':4A,29B,63C 'interact':106C 'issu':101C 'let':7A 'leverag':77C 'measur':83C 'outsid':52B 'packag':22B 'requir':104C 'result':68C 'secur':10A,36B,71C,82C 'succeed':41B 'though':47B 'unauthor':44B,86C 'user':105C 'valid':5A,30B,64C 'vulner':65C,79C 'write':45B,87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["caicontentcredentials","medium","package"],"campaign_type":null,"search_a":"'-113573':14A,17A '-2026':13A,16A 'attack':8A 'bypass':9A 'cai':1A 'check':11A 'content':2A 'credenti':3A 'cve':12A,15A 'flaw':6A 'input':4A 'let':7A 'secur':10A 'valid':5A","search_b":"'access':46B 'attack':39B 'bypass':34B 'cai':19B,23B 'cai-content-credenti':18B 'condit':51B 'content':20B,24B 'control':54B 'credenti':21B,25B 'depend':49B 'exploit':48B 'featur':37B 'flaw':31B 'gain':43B 'improp':28B 'input':29B 'outsid':52B 'packag':22B 'secur':36B 'succeed':41B 'though':47B 'unauthor':44B 'valid':30B 'write':45B","search_c":"'access':88C 'affect':59C 'attack':75C,95C 'beyond':93C 'bypass':73C,81C 'cai':55C 'condit':92C 'content':56C 'control':97C 'could':67C,76C 'credenti':57C 'depend':90C 'exploit':89C,98C 'featur':72C 'gain':85C 'improp':62C 'input':63C 'interact':106C 'issu':101C 'leverag':77C 'measur':83C 'requir':104C 'result':68C 'secur':71C,82C 'unauthor':86C 'user':105C 'valid':64C 'vulner':65C,79C 'write':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113573","severity":null,"published_at":"2026-11-10T22:18:21+00:00","modified_at":"2026-11-10T22:18:21+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","fetched_at":"2026-11-10T22:27:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}