EUVD-2026-38369Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because a valid subkey credential is required; S:U as escalation remains within the Capgo API boundary; no availability impact evident.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.
AnalysisAI
Subkey permission bypass in Capgo before 12.128.2 allows authenticated API users to escalate from restricted subkey scope to full main API key privileges by sending malformed x-limited-key-id header values. The parsing flaw - triggered by submitting zero, NaN-coercible, or duplicate header values - causes the subkey scoping enforcement to evaluate to falsy, silently falling through to the unrestricted main API key context. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any holder of a valid subkey credential.
Technical ContextAI
Capgo (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*) is an over-the-air (OTA) update delivery platform for Capacitor-based mobile applications. Its API implements a subkey permission model where the x-limited-key-id HTTP header is used to scope incoming requests to a restricted credential context with reduced privileges. CWE-20 (Improper Input Validation) is the root cause: the server-side parsing logic fails to sanitize or strictly validate the header value before using it in an authorization decision. In JavaScript/TypeScript environments, values like 0, empty strings, or NaN are falsy, meaning a strict equality or truthiness check against a well-formed key ID silently fails and the code falls back to the main API key path. Duplicate header submission can produce array-type values that similarly fail numeric comparison, producing the same bypass. The flaw is a classic input validation gap at an authorization gate rather than a cryptographic or protocol-level weakness.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is confirmed as the patched release per the vendor security advisory GHSA-42vv-8j94-24wj at https://github.com/Cap-go/capgo/security/advisories/GHSA-42vv-8j94-24wj. As a compensating control prior to patching, operators should audit all issued subkeys and consider revoking any that are not actively in use, reducing the attack surface. API gateway or WAF rules that enforce strict numeric validation and reject duplicate or empty x-limited-key-id header values can block the malformed-header bypass paths, though this requires careful tuning to avoid disrupting legitimate traffic. Monitoring API logs for requests where x-limited-key-id is absent, zero, or produces a header array may help detect exploitation attempts. The primary and recommended action remains patching to 12.128.2.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today