Is there a patch available for CVE-2026-56224?

Yes, a patch is available for CVE-2026-56224. Update the affected software to the latest version immediately.

Capgo CVE-2026-56224

Q: What is the CVSS score of CVE-2026-56224?

CVE-2026-56224 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40426 MEDIUM

Session Fixation (CWE-384)

2026-06-30 VulnCheck

GHSA-5ph3-fx7r-fpq3

Session Fixation Information Disclosure Capgo

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-delivered session fixation requires victim to click a crafted URL (UI:R); attacker needs no privileges; confidentiality and integrity impacts are low with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:39 vuln.today

DescriptionCVE.org

Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.

AnalysisAI

Session fixation in the Capgo cloud console login endpoint (console.capgo.app/login) allows unauthenticated remote attackers to force victims into attacker-controlled sessions by crafting malicious URLs containing attacker-owned tokens. Versions before 12.128.2 silently accept access_token and refresh_token as URL query parameters and authenticate the user without confirmation, bypassing normal login flows. Tokens passed via URL are additionally exposed in browser history, server access logs, and HTTP Referer headers, creating secondary information-disclosure risk. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

Capgo is an over-the-air (OTA) update and deployment platform for Capacitor-based mobile applications, operated as a SaaS product at console.capgo.app. The vulnerability is classified as CWE-384 (Session Fixation): the login endpoint processes access_token and refresh_token directly from HTTP GET query parameters, allowing any caller to pre-load arbitrary tokens into a browser session without the user's knowledge or consent. Accepting bearer tokens via URL violates OAuth 2.0 security best practices (RFC 6749 Section 3.3) because query parameters are durably logged by web servers, CDN edge nodes, reverse proxies, and the browser's own history and autocomplete, and leak to third-party origins via the HTTP Referer header. The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covering all versions prior to 12.128.2.

RemediationAI

The primary fix is to upgrade Capgo to version 12.128.2 or later, which removes acceptance of access_token and refresh_token via URL query parameters; the vendor advisory is at https://github.com/Cap-go/capgo/security/advisories/GHSA-83f5-439g-pwmj. For self-hosted deployments that cannot immediately upgrade, configure web application firewall (WAF) rules to block or strip requests to the /login endpoint that include access_token or refresh_token as query parameters - note this may interfere with any legitimate OAuth callback flows that use the same parameter names, so scope rules carefully. Additionally, advise Capgo users to inspect login URLs before clicking and to rotate tokens immediately after any suspected exposure. Enabling server-side session monitoring to flag sessions originating from unexpected IP addresses or user agents can provide detection capability while a patch is pending. Upstream fix availability is confirmed by vendor advisory; the patched version number (12.128.2) is confirmed by the GHSA advisory.