EUVD-2026-38095
GHSA-9wvh-mc26-36xw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated signup endpoint with no user interaction yields PR:N/UI:N/AC:L; account takeover gives C:H/I:H, but no service disruption so A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-level policies, while the legitimate user is denied access to the account tied to their own email.
AnalysisAI
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a victim's email address before that email is verified, then lock the legitimate owner out by enabling two-factor authentication on the squatted account. The flaw stems from a CWE-640 weak password recovery / account-binding logic issue and carries a CVSS 4.0 score of 9.3; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Capgo is an open-source live/over-the-air update platform for Capacitor mobile apps (CPE cpe:2.3:a:cap-go:capgo). The root cause is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), but applied to the account-creation/identity-binding flow: Capgo treats an email address as the canonical account identifier yet allows a session and authenticated state to persist on an account whose email was never proven via a verification round trip. Compounding the design flaw, the application permits security-sensitive operations - specifically enrollment of a TOTP/second factor - on this unverified account, which cryptographically anchors control to the attacker's device and prevents subsequent reclamation by the real owner even after they attempt a password reset on the same address.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later as instructed in GHSA-j4cx-5pw6-5v5j (https://github.com/Cap-go/capgo/security/advisories/GHSA-j4cx-5pw6-5v5j). If immediate upgrade is not possible, compensating controls include disabling self-service signup at the reverse proxy or front-end so accounts can only be provisioned by an administrator after out-of-band identity confirmation (trade-off: blocks legitimate new-user onboarding), blocking enrollment of a second factor until the email-verification token has been consumed (requires code/config change and may temporarily weaken MFA coverage for new users), and proactively auditing the user table for accounts whose email_verified flag is false but which already have a TOTP secret or backup codes registered - these are candidate hijacked accounts that should be administratively reset and re-bound to the rightful owner. After patching, force a verification re-challenge on all accounts created during the vulnerable window.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today