EUVD-2026-42882
GHSA-j3rw-h6r5-mm7x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote endpoint (AV:N/AC:L) but a valid session is needed (PR:L, not PR:N); takeover yields high confidentiality and integrity, with lockout as limited availability impact (A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.
AnalysisAI
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.
Technical ContextAI
Capgo is a live/over-the-air (OTA) update service for Capacitor-based mobile applications, providing a backend and dashboard where developers manage app bundles and user accounts (cpe:2.3:a:capgo:capgo). The root cause is CWE-620 (Unverified Password Change): the password-change endpoint updates the stored credential based solely on the authenticated session context, without re-authenticating the requester by requiring the current password. Current-password confirmation is the standard defense-in-depth control that ensures a live session alone cannot silently reset a credential; its absence means session possession is treated as equivalent to knowledge of the account secret, collapsing the distinction between session hijack and full credential compromise.
RemediationAI
Vendor-released patch: 12.128.2 - upgrade Capgo to 12.128.2 or later, as documented in GHSA-rjr5-qxqj-cx8g (https://github.com/Cap-go/capgo/security/advisories/GHSA-rjr5-qxqj-cx8g) and the VulnCheck advisory. Until the upgrade is applied, reduce the blast radius of a borrowed session by shortening session/token lifetimes and forcing re-authentication for sensitive account actions, and invalidate existing sessions after any suspected compromise (trade-off: more frequent logins for users). If you can control the reverse proxy or WAF, restrict or add step-up authentication in front of the password-change endpoint (trade-off: may block legitimate self-service password changes), and monitor for password-change events not accompanied by a fresh login as a detection compensating control. Do not rely on network controls alone, since the attack originates from an already-valid session.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same weakness CWE-620 – Unverified Password Change
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today