Capgo CVE-2026-56234

The attacker must possess the public Supabase anon key for the target Capgo instance. This key is embedded in all distributed Capgo client apps and is not considered a secret by Supabase's design - any user who downloads the app, intercepts network traffic, or decompiles the binary can retrieve it. The target must be running Capgo prior to version 12.128.2. No authentication beyond this public key is required, no specific server-side configuration is needed, and no user interaction is involved. Exploitation is constrained to credential validation responses - the endpoint does not directly return passwords or tokens, so account takeover requires the attacker to separately obtain usernames (e.g., from public data or prior breaches) and iterate password candidates. Network access to the Supabase project URL is the only infrastructure requirement.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely exploitable, requires no authentication, and has no attack complexity or special conditions - consistent with the description, since the public Supabase anon key is embedded in every shipped app. The CVSS 4.0 score of 6.9 reflects only limited direct confidentiality impact (VC:L), as the endpoint validates rather than directly discloses secrets. However, this score understates practical risk: successful credential stuffing enables full account takeover of Capgo accounts, which control mobile app update distribution and could be leveraged to push malicious updates to end users. No EPSS data or CISA KEV listing was provided, so statistical exploitation probability is unknown. The attack is trivially automatable (no rate limit, no lockout, public key suffices), meaning the realistic threat level exceeds what the CVSS score alone conveys. No conflicting signals were found between the CVSS vector and the textual description - both align on a no-authentication, network-exploitable flaw.

An attacker decompiles or proxies a Capgo-connected mobile app to extract the public Supabase anon key from its configuration. They then run an automated credential stuffing tool - such as a simple Python script using a list of breached email/password combos - sending POST requests to /functions/v1/private/validate_password_compliance at an unrestricted rate. Successful matches identify valid Capgo account credentials, which the attacker then uses to log in and potentially manipulate live update bundles delivered to end users.