{"id":"CVE-2026-122101","kind":"vulnerability","aliases":["CVE-2026-122101"],"related":[],"title":"CAI Content Credentials: input validation flaw allows security feature bypass","description":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.","summary":"CAI Content Credentials has an input validation flaw that lets an attacker bypass a security feature. The bypass gives limited unauthorized write access, but exploitation depends on conditions outside the attacker's control.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CAI Content Credentials","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cai-content-credentials","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:31:05+00:00","updated_at":"2026-11-10T22:31:05+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T22:31:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CAI Content Credentials: input validation flaw allows security feature bypass","impact":"medium","summary":"CAI Content Credentials has an input validation flaw that lets an attacker bypass a security feature. The bypass gives limited unauthorized write access, but exploitation depends on conditions outside the attacker's control.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cai-content-credentials"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains limited unauthorized write access via security bypass","analyst_note":"Confirm affected versions, fixed version and attack prerequisites from the vendor advisory or NVD CPE data at https://nvd.nist.gov/vuln/detail/CVE-2026-122101.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000661,"input_tokens":4561,"output_tokens":409,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-122101':13A,16A '-2026':12A,15A 'access':46B,91C 'affect':61C 'allow':7A 'attack':35B,54B,77C,98C 'beyond':96C 'bypass':10A,36B,41B,75C,83C 'cai':1A,17A,21B,24B,57C 'cai-content-credenti':20B 'condit':51B,95C 'content':2A,18A,22B,25B,58C 'control':56B,100C 'could':69C,78C 'credenti':3A,23B,26B,59C 'credentials':19A 'cve':11A,14A 'depend':49B,93C 'exploit':48B,92C,101C 'featur':9A,39B,74C 'flaw':6A,31B 'gain':87C 'give':42B 'improp':64C 'input':4A,29B,65C 'interact':109C 'issu':104C 'let':33B 'leverag':79C 'limit':43B,89C 'measur':85C 'outsid':52B 'requir':107C 'result':70C 'secur':8A,38B,73C,84C 'unauthor':44B,88C 'user':108C 'valid':5A,30B,66C 'vulner':67C,81C 'write':45B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["caicontentcredentials","contentcredentials"],"ptokens":["cai","content","credentials"],"labels":["caicontentcredentials","low","other","vendor"],"campaign_type":null,"search_a":"'-122101':13A,16A '-2026':12A,15A 'allow':7A 'bypass':10A 'cai':1A,17A 'content':2A,18A 'credenti':3A 'credentials':19A 'cve':11A,14A 'featur':9A 'flaw':6A 'input':4A 'secur':8A 'valid':5A","search_b":"'access':46B 'attack':35B,54B 'bypass':36B,41B 'cai':21B,24B 'cai-content-credenti':20B 'condit':51B 'content':22B,25B 'control':56B 'credenti':23B,26B 'depend':49B 'exploit':48B 'featur':39B 'flaw':31B 'give':42B 'input':29B 'let':33B 'limit':43B 'outsid':52B 'secur':38B 'unauthor':44B 'valid':30B 'write':45B","search_c":"'access':91C 'affect':61C 'attack':77C,98C 'beyond':96C 'bypass':75C,83C 'cai':57C 'condit':95C 'content':58C 'control':100C 'could':69C,78C 'credenti':59C 'depend':93C 'exploit':92C,101C 'featur':74C 'gain':87C 'improp':64C 'input':65C 'interact':109C 'issu':104C 'leverag':79C 'limit':89C 'measur':85C 'requir':107C 'result':70C 'secur':73C,84C 'unauthor':88C 'user':108C 'valid':66C 'vulner':67C,81C 'write':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122101","severity":null,"published_at":"2026-11-10T22:18:28+00:00","modified_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}