EUVD-2026-38429
GHSA-74wf-7q7r-hjxr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:N because the public anon key is non-secret; C:L for credential oracle exposure; I:L because successful spraying enables account takeover with downstream integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate limiting, enabling attackers to perform password spraying and credential stuffing attacks to compromise user accounts.
AnalysisAI
Unauthenticated access to Capgo's credential validation endpoint before version 12.128.2 enables large-scale password spraying and credential stuffing attacks against user accounts. The POST /functions/v1/private/validate_password_compliance Supabase Edge Function accepts requests using only the publicly distributed anon key - a client-side secret embedded in shipped app binaries - with no rate limiting or lockout enforcement. Combined with wildcard CORS headers, any browser-side or scripted attacker can systematically validate username/password pairs at scale, ultimately compromising Capgo accounts and potentially tampering with mobile app live update pipelines. No public exploit code has been identified at time of analysis, but the attack is trivially automatable given the absence of access controls.
Technical ContextAI
Capgo is a live update delivery platform for Capacitor-based mobile applications, built on Supabase serverless Edge Functions. The affected endpoint /functions/v1/private/validate_password_compliance is a Supabase Edge Function that despite its /private/ path prefix accepts the public Supabase anon key as its sole credential - a key that is by design distributed to all app clients and considered non-secret. CWE-307 (Improper Restriction of Excessive Authentication Attempts) describes the root cause: the endpoint performs authentication-adjacent work (credential validation) without any rate limiting, IP throttling, CAPTCHA, or account lockout mechanism, making it an oracle for mass credential enumeration. The wildcard CORS policy (Access-Control-Allow-Origin: *) further enables browser-based cross-site exploitation. Affected CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* for all versions prior to 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later as documented in the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-f6v3-xv4g-79h5. If immediate patching is not feasible, restrict network-level access to the /functions/v1/private/validate_password_compliance endpoint using Supabase Edge Function access policies or an upstream API gateway - this may impact legitimate password compliance validation flows and should be tested before deployment. As a compensating control, enforce IP-based rate limiting at the Supabase project or reverse-proxy layer to throttle repeated calls to the endpoint; note this does not fix the authentication bypass but meaningfully raises the cost of spraying at scale. Long-term, the endpoint should require a service-role JWT rather than the public anon key, aligning its access model with its /private/ path intent.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today