EUVD-2026-38126
GHSA-cg8c-732h-jg2p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint, low-privilege auth required, victim interaction mandatory; scope changes as redirect escapes to attacker-controlled external domain.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft malicious billing URLs to redirect users to attacker-controlled domains for phishing and credential harvesting.
AnalysisAI
Open redirect in Capgo's Stripe billing endpoints (stripe_portal and stripe_checkout) allows authenticated attackers to manipulate the callbackUrl, successUrl, and cancelUrl parameters to silently redirect users to attacker-controlled phishing domains after billing interactions. All Capgo releases before 12.128.2 are affected per vendor advisory GHSA-grc7-98pf-h8hq. Exploitation requires a valid Capgo account (CVSS PR:L) and victim interaction (UI:A), and no public exploit or CISA KEV listing exists at time of analysis; however, the Stripe payment context lends phishing lures unusual credibility, elevating realistic social-engineering risk above what the medium CVSS score alone implies.
Technical ContextAI
Capgo (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*) is an open-source mobile application live-update and deployment platform. The vulnerability exists in server-side HTTP endpoint handlers for Stripe payment flows - specifically stripe_portal (customer billing portal) and stripe_checkout (payment checkout). These endpoints accept URL parameters (callbackUrl, successUrl, cancelUrl) that dictate post-payment browser redirect destinations. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) identifies the root cause: the server performs no domain allowlisting or validation against trusted origins before issuing HTTP redirects to caller-supplied URLs, allowing arbitrary external destinations. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) confirms the endpoint is network-reachable, requires no unusual attack conditions, demands low-privilege authentication, and requires the victim to interact with the crafted link.
RemediationAI
Upgrade to Capgo version 12.128.2 or later, which is confirmed by the vendor advisory (GHSA-grc7-98pf-h8hq) and EUVD-2026-38126 as the fix release implementing validation of redirect URL parameters. The vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-grc7-98pf-h8hq and VulnCheck's advisory at https://www.vulncheck.com/advisories/capgo-open-redirect-via-unvalidated-stripe-billing-urls should be consulted for patch details. If immediate upgrade is not feasible, a compensating control is to block or restrict external access to the stripe_portal and stripe_checkout endpoints at the reverse proxy or WAF layer - though this will disrupt billing portal functionality for users. A WAF rule rejecting callbackUrl, successUrl, and cancelUrl values containing non-allowlisted hostnames can serve as a temporary mitigation; note that WAF bypass techniques exist and this should not substitute for patching. No other vendor-documented workarounds are available from the provided intelligence.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today