EUVD-2026-38116
GHSA-j8w3-fhfr-rrvp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated organization administrator access to modify password policy (PR:H, AV:N, AC:L); impact is purely high-severity availability loss with no confidentiality or integrity effects, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimum password length, making compliance impossible for all organization members. Once the policy is enabled, users (including administrators) are unable to change their passwords or access the organization, resulting in an organization-wide account lockout and application-level denial of service.
AnalysisAI
Capgo's password policy configuration in versions before 12.128.2 can be exploited by an authenticated organization administrator to trigger an organization-wide account lockout by setting an arbitrarily large minimum password length - such as billions of characters - with no server-side upper-bound enforcement. Once the malicious policy is enabled, every organization member including other administrators is prevented from setting a compliant password, permanently blocking access to the organization and constituting an application-level denial of service. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the insider-threat and compromised-admin-credential risk category.
Technical ContextAI
Capgo is an open-source live-update platform for Capacitor-based mobile applications, providing organization-scoped user and access management including password policy controls. The vulnerability is rooted in CWE-20 (Improper Input Validation): the minimum password length field in the password policy configuration module accepts arbitrarily large integer values without enforcing a maximum bound. When such a value is persisted and the policy is activated, the enforcement logic compares every password-change attempt against the stored minimum, and since no user can realistically supply a password of billions of characters, all password operations fail indefinitely. Affected products per CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covering all releases from version 0 up to but not including 12.128.2.
RemediationAI
The primary remediation is to upgrade Capgo to version 12.128.2 or later, which introduces server-side enforcement of a maximum allowable value for the minimum password length field, closing the improper input validation gap. The vendor patch is documented in the GitHub Security Advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-vhjp-62qf-33mx and the VulnCheck advisory at https://www.vulncheck.com/advisories/capgo-denial-of-service-via-improper-password-policy-length-validation. Until patching is feasible, compensating controls should focus on limiting exposure of the organization administrator role: audit all accounts holding that privilege and revoke it from any that do not strictly require it, as reducing the set of admins directly reduces attack surface. Additionally, audit existing password policy configurations for any anomalous minimum length values and reset them to sane defaults. Implement alerting on password policy modification events in administrator audit logs to detect abuse in near-real-time. Note that none of these workarounds prevent a legitimate but malicious admin from triggering the condition - they only reduce the probability that such an actor exists.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today