{"id":"CVE-2026-123262","kind":"vulnerability","aliases":["CVE-2026-123262"],"related":[],"title":"CAI Content Credentials: signature verification flaw allows security bypass and write access","description":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.","summary":"CAI Content Credentials fails to properly verify a cryptographic signature, so an attacker can get past a security check. The sources say this can lead to unauthorized write access, and exploitation needs conditions outside the attacker's control.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cai-content-credentials","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:29+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:29:22+00:00","updated_at":"2026-11-10T22:29:22+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T22:29:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CAI Content Credentials: signature verification flaw allows security bypass and write access","impact":"medium","summary":"CAI Content Credentials fails to properly verify a cryptographic signature, so an attacker can get past a security check. The sources say this can lead to unauthorized write access, and exploitation needs conditions outside the attacker's control.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cai-content-credentials"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains unauthorized write access past signature checks","analyst_note":"Find the affected versions, the fixed release and the vendor advisory at the NVD entry; the sources given name no products or ranges.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4571,"output_tokens":386,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123262':15A,18A '-2026':14A,17A 'access':12A,51B,96C 'affect':65C 'allow':7A 'attack':35B,58B,83C,103C 'beyond':101C 'bypass':9A,81C,89C 'cai':1A,20B,23B,61C 'cai-content-credenti':19B 'check':41B 'condit':55B,100C 'content':2A,21B,24B,62C 'control':60B,105C 'could':75C,84C 'credenti':3A,22B,25B,63C 'cryptograph':31B,71C 'cve':13A,16A 'depend':98C 'exploit':53B,97C,106C 'fail':26B 'featur':80C 'flaw':6A 'gain':93C 'get':37B 'improp':68C 'interact':114C 'issu':109C 'lead':47B 'leverag':85C 'measur':91C 'need':54B 'outsid':56B 'past':38B 'proper':28B 'requir':112C 'result':76C 'say':44B 'secur':8A,40B,79C,90C 'signatur':4A,32B,72C 'sourc':43B 'unauthor':49B,94C 'user':113C 'verif':5A,69C 'verifi':29B 'vulner':73C,87C 'write':11A,50B,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["caicontentcredentials","medium","other"],"campaign_type":null,"search_a":"'-123262':15A,18A '-2026':14A,17A 'access':12A 'allow':7A 'bypass':9A 'cai':1A 'content':2A 'credenti':3A 'cve':13A,16A 'flaw':6A 'secur':8A 'signatur':4A 'verif':5A 'write':11A","search_b":"'access':51B 'attack':35B,58B 'cai':20B,23B 'cai-content-credenti':19B 'check':41B 'condit':55B 'content':21B,24B 'control':60B 'credenti':22B,25B 'cryptograph':31B 'exploit':53B 'fail':26B 'get':37B 'lead':47B 'need':54B 'outsid':56B 'past':38B 'proper':28B 'say':44B 'secur':40B 'signatur':32B 'sourc':43B 'unauthor':49B 'verifi':29B 'write':50B","search_c":"'access':96C 'affect':65C 'attack':83C,103C 'beyond':101C 'bypass':81C,89C 'cai':61C 'condit':100C 'content':62C 'control':105C 'could':75C,84C 'credenti':63C 'cryptograph':71C 'depend':98C 'exploit':97C,106C 'featur':80C 'gain':93C 'improp':68C 'interact':114C 'issu':109C 'leverag':85C 'measur':91C 'requir':112C 'result':76C 'secur':79C,90C 'signatur':72C 'unauthor':94C 'user':113C 'verif':69C 'vulner':73C,87C 'write':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123262","severity":null,"published_at":"2026-11-10T22:18:29+00:00","modified_at":"2026-11-10T22:18:29+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}