EUVD-2026-38121
GHSA-58pv-hg46-37r9
Severity by source
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical vector and high complexity required (Frida hooking on rooted device); no prior app privileges needed; no availability impact; integrity impact limited to auth state bypass.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.
AnalysisAI
Authentication bypass in cap-go/capacitor-native-biometric allows an attacker with physical device access to circumvent biometric authentication by hooking the onAuthenticationSucceeded() callback via dynamic instrumentation. The root cause is that AuthActivity.java's implementation of BiometricPrompt.AuthenticationCallback never retrieves or validates the CryptoObject from the AuthenticationResult, making the entire cryptographic binding between biometric gesture and protected key material moot. All npm package versions below the patched release are affected. A proof-of-concept video is publicly available per the GHSA advisory, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
The Android BiometricPrompt API offers a CryptoObject binding mode in which a successful biometric gesture unlocks a cryptographic key inside the Android Keystore; downstream code must then use that CryptoObject to decrypt or sign data, preventing replay or hooking attacks. The vulnerable implementation in AuthActivity.java (line 88 per GHSA) overrides onAuthenticationSucceeded() but immediately calls finishActivity('success') without ever interrogating result.getCryptoObject(). This means the security contract the CryptoObject pattern is supposed to enforce - 'only proceed if the hardware-bound key was unlocked by a genuine biometric gesture' - is never checked. The CWE-287 (Improper Authentication) root cause is that authentication outcome is trusted based solely on the callback invocation rather than on cryptographic proof. Dynamic instrumentation frameworks such as Frida can inject into the running app process on a rooted or debuggable Android device and trigger onAuthenticationSucceeded() synthetically, making the biometric gate trivially bypassable. The affected CPE is cpe:2.3:a:capacitor-native-biometric:capacitor-native-biometric:*:*:*:*:*:*:*:*.
RemediationAI
Update @capgo/capacitor-native-biometric to the patched version via npm: run 'npm install @capgo/capacitor-native-biometric@latest' and verify the installed version is at or above 8.3.6 (per npm evidence) or 12.128.2 (per EUVD/CVE description). The fix commit is confirmed at https://github.com/Cap-go/capacitor-native-biometric/commit/1254602e942f8216e6258f646f0866d8e69c48a5 and the vendor advisory is at https://github.com/Cap-go/capgo/security/advisories/GHSA-vx5f-vmr6-32wf. For applications that cannot patch immediately, the primary compensating control is to enforce server-side re-authentication for any sensitive operation protected by biometric prompt, so that bypassing the local biometric gate does not grant access to back-end resources without a valid session token. Disabling the biometric feature entirely and falling back to PIN/password is a functional alternative with user-experience trade-offs. Note: relying solely on Android root-detection or certificate pinning as a mitigation is insufficient, as those controls can themselves be bypassed with the same instrumentation tooling used in this attack.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today