CVE-2026-48290: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe Content Credentials Rust SDK

The Adobe Content Credentials Rust SDK is affected by an SSRF vulnerability (CWE-918) that enables an attacker to induce the server to perform unintended requests. This can lead to arbitrary code execution with the privileges of the current user. The attack requires user interaction, specifically that the victim visits a maliciously crafted URL or interacts with a compromised web page. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 base score of 8.2, indicating high severity. No patch or remediation level has been published yet, and no affected versions are explicitly stated.

Successful exploitation can lead to arbitrary code execution in the context of the current user, potentially allowing attackers to inject malicious scripts, gain elevated access, or take control over victim accounts or sessions. The confidentiality and integrity of the affected system are highly impacted, while availability remains unaffected. The vulnerability requires user interaction, which limits the attack vector to scenarios involving victim engagement with malicious content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor Adobe's advisories for updates. Until a patch is available, limit exposure by controlling user interactions with untrusted URLs and web content where possible.