{"id":"CVE-2026-118484","kind":"vulnerability","aliases":["CVE-2026-118484"],"related":[],"title":"CAI Content Credentials: input validation flaw lets attackers bypass security features","description":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.","summary":"CAI Content Credentials, a tool for attaching provenance metadata to digital content, has an improper input validation flaw. A remote attacker can bypass security measures and gain unauthorized write access if a victim opens a crafted URL or visits a compromised page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CAI Content Credentials","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cai-content-credentials","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:24+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","triaged_at":"2026-11-10T22:29:15+00:00","updated_at":"2026-11-10T22:29:15+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T22:29:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CAI Content Credentials: input validation flaw lets attackers bypass security features","impact":"medium","summary":"CAI Content Credentials, a tool for attaching provenance metadata to digital content, has an improper input validation flaw. A remote attacker can bypass security measures and gain unauthorized write access if a victim opens a crafted URL or visits a compromised page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cai-content-credentials"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains unauthorized write access after victim visits a malicious page","analyst_note":"Find the affected product versions and vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-118484 to fill in how_to_check and fix.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4567,"output_tokens":420,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118484':14A,17A '-2026':13A,16A 'access':54B,100C 'affect':71C 'attach':31B 'attack':8A,45B,87C 'bypass':9A,47B,85C,93C 'cai':1A,18A,22B,25B,67C 'cai-content-credenti':21B 'compromis':65B,122C 'content':2A,19A,23B,26B,36B,68C 'could':79C,88C 'craft':60B,116C 'credenti':3A,24B,27B,69C 'credentials':20A 'cve':12A,15A 'digit':35B 'exploit':101C 'featur':11A,84C 'flaw':6A,42B 'gain':51B,97C 'improp':39B,74C 'input':4A,40B,75C 'interact':107C,119C 'issu':104C 'let':7A 'leverag':89C 'malici':115C 'measur':49B,95C 'metadata':33B 'must':112C 'open':58B 'page':66B,124C 'proven':32B 'remot':44B 'requir':105C 'result':80C 'secur':10A,48B,83C,94C 'tool':29B 'unauthor':52B,98C 'url':61B,117C 'user':106C 'valid':5A,41B,76C 'victim':57B,111C 'visit':63B,113C 'vulner':77C,91C 'web':123C 'write':53B,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["caicontentcredentials","contentcredentials"],"ptokens":["cai","content","credentials"],"labels":["caicontentcredentials","medium","other","vendor"],"campaign_type":null,"search_a":"'-118484':14A,17A '-2026':13A,16A 'attack':8A 'bypass':9A 'cai':1A,18A 'content':2A,19A 'credenti':3A 'credentials':20A 'cve':12A,15A 'featur':11A 'flaw':6A 'input':4A 'let':7A 'secur':10A 'valid':5A","search_b":"'access':54B 'attach':31B 'attack':45B 'bypass':47B 'cai':22B,25B 'cai-content-credenti':21B 'compromis':65B 'content':23B,26B,36B 'craft':60B 'credenti':24B,27B 'digit':35B 'flaw':42B 'gain':51B 'improp':39B 'input':40B 'measur':49B 'metadata':33B 'open':58B 'page':66B 'proven':32B 'remot':44B 'secur':48B 'tool':29B 'unauthor':52B 'url':61B 'valid':41B 'victim':57B 'visit':63B 'write':53B","search_c":"'access':100C 'affect':71C 'attack':87C 'bypass':85C,93C 'cai':67C 'compromis':122C 'content':68C 'could':79C,88C 'craft':116C 'credenti':69C 'exploit':101C 'featur':84C 'gain':97C 'improp':74C 'input':75C 'interact':107C,119C 'issu':104C 'leverag':89C 'malici':115C 'measur':95C 'must':112C 'page':124C 'requir':105C 'result':80C 'secur':83C,94C 'unauthor':98C 'url':117C 'user':106C 'valid':76C 'victim':111C 'visit':113C 'vulner':77C,91C 'web':123C 'write':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118484","severity":null,"published_at":"2026-11-10T22:18:24+00:00","modified_at":"2026-11-10T22:18:24+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}