Server-Side Request Forgery (SSRF) in Adobe products - CVE-2026-47922
Published: August 14, 2026
Vulnerability identifier: #VU142522
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-47922
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to server-side request forgery in the Content Credentials SDK when handling requests. A remote attacker can send a specially crafted request to bypass security features.
User interaction is required.
Affected software
C2PA Tool
Content Credentials JS SDK
Content Credentials Rust SDK
Content Credentials JS SDK
Content Credentials Rust SDK
How to mitigate CVE-2026-47922
Install security update from vendor's website.
C2PA Tool - update to 0.27.6
Content Credentials JS SDK - update to 0.12.1
Content Credentials Rust SDK - update to 0.90.6
Content Credentials JS SDK - update to 0.12.1
Content Credentials Rust SDK - update to 0.90.6