EUVD-2026-38092
GHSA-g359-4vg7-88hp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable verification endpoint, low complexity (intercepting proxy), no prior auth or victim interaction needed; high confidentiality/integrity from account takeover, limited availability via lockout.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.
AnalysisAI
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering with HTTP responses returned to the client, which the application trusts to decide whether verification succeeded. Successful exploitation enables fraudulent 2FA enrollment and account takeover, and no public exploit has been identified at time of analysis though VulnCheck has published an advisory describing the response-manipulation technique.
Technical ContextAI
Capgo is a self-hostable live-update and OTA delivery platform for Capacitor mobile apps that uses a Supabase-backed account system, where email OTP verification is one gate for enabling 2FA and securing user accounts. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): the verification flow treats the HTTP response body or status returned to the client as the source of truth for whether the user-supplied OTP matched, rather than relying solely on a server-side decision bound to a signed/session-scoped state. Because the success signal is a client-observable response field, anyone able to alter that response - via an intercepting proxy on their own client, a manipulated app build, or a MitM position - can flip the verification result without ever knowing the real OTP.
RemediationAI
Upgrade to vendor-released patch Capgo 12.128.2 or later, which addresses the OTP verification flow as documented in GHSA-x2gq-85v8-j9v4 (https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4). If immediate upgrade is not possible, treat email-verified state as untrusted until the patch is applied: temporarily disable self-service 2FA enablement that relies on the email-OTP gate, require an out-of-band confirmation (such as an admin-issued link or a session re-authentication) before promoting an account to verified, and audit recent 2FA enrollments and email-verification events for anomalies - accepting that disabling self-service 2FA increases friction and may degrade user security posture in the short term, so the workaround should be paired with an accelerated patch window.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today