EUVD-2026-42879
GHSA-v24w-qp6p-4wjw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must first achieve MITM or server compromise; PR:N/UI:N since no device-side privileges or interaction are needed; impact is integrity-dominant (I:H) with limited C/A from malicious-update installation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by the original app maker.
AnalysisAI
Update-signing bypass in @capgo/capacitor-updater (capgo OTA plugin for Capacitor apps) before 12.128.2 undermines its end-to-end encryption by shipping the same private key to every device that downloads the app. Because the public verification key can be derived from that distributed private key, an attacker with a man-in-the-middle position or control of the Capgo delivery server can forge a validly signed update bundle and push attacker-controlled code to devices. Reported by VulnCheck with a CVSS 4.0 base score of 8.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Capacitor Updater (capgo) is a live/over-the-air (OTA) update plugin for Ionic Capacitor mobile applications that lets developers ship JavaScript/web bundle updates without going through app-store review. To protect update authenticity it uses an end-to-end encryption/signing scheme intended to guarantee that only bundles produced by the original app maker are installed. The flaw is a key-management failure (CWE-320, Key Management Errors): rather than keeping the signing private key secret on the publisher side and distributing only the public key, the implementation distributes the private key to each downloading device. Since an asymmetric public key is mathematically derivable from its private key, possession of the client-side private material lets anyone reconstruct the full keypair and produce signatures that pass verification - collapsing the trust model to that of an unsigned channel. The single affected component is cpe:2.3:a:capacitor-updater:capacitor-updater, tagged as an Information Disclosure / Capacitor Updater issue.
RemediationAI
Vendor-released patch: upgrade @capgo/capacitor-updater to 12.128.2 or later, then rebuild and re-release the mobile app so devices carry the corrected key-handling logic; note that because the private key was already distributed with vulnerable builds, you should also treat the old signing keypair as compromised and rotate to a freshly generated keypair rather than reusing existing keys. Follow the vendor guidance in GHSA-j2f4-4pfc-p8rx (https://github.com/Cap-go/capgo/security/advisories/GHSA-j2f4-4pfc-p8rx) and the VulnCheck writeup (https://www.vulncheck.com/advisories/capacitor-updater-end-to-end-encryption-bypass-via-private-key-distribution). Until app updates propagate, reduce the man-in-the-middle exposure by enforcing TLS certificate/public-key pinning on the update endpoint and serving updates only over hardened HTTPS (trade-off: pinning complicates future certificate rotation), and tighten access controls and monitoring on the Capgo delivery server to limit the server-compromise path (trade-off: operational overhead but no functional impact on end users). Disabling OTA updates entirely is the strongest stopgap but removes the ability to ship fixes out-of-band.
Same weakness CWE-320 – Key Management Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today