EUVD-2026-38127
GHSA-8pv8-j6gq-48m4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible open redirect requiring victim to click a crafted link (UI:R, PR:N); impact is limited integrity manipulation via redirect, with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks.
AnalysisAI
Open redirect in Capgo's confirm-signup endpoint (all versions before 12.128.2) enables unauthenticated remote attackers to craft account confirmation links that silently redirect victims to arbitrary attacker-controlled websites. The unvalidated confirmation_url parameter in the confirm-signup flow accepts any external URL without domain allowlisting or sanitization, making legitimate Capgo-sending domains a trusted launchpad for phishing and credential harvesting. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the social engineering amplification risk is significant given the trusted-email-domain context.
Technical ContextAI
Capgo is an open-source live update and backend platform for Capacitor mobile applications. The vulnerability resides in the confirm-signup endpoint, which is responsible for handling email address verification flows after user registration. Per CWE-601 (URL Redirection to Untrusted Site / Open Redirect), the root cause is the complete absence of server-side validation or allowlisting on the confirmation_url parameter - the application forwards the user-supplied value directly without checking it against a whitelist of legitimate application domains. This transforms the confirmation email flow into an attacker-controllable redirect primitive. CPE data cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* confirms the scope spans all Capgo releases across the entire version lineage prior to 12.128.2, affecting both self-hosted and any cloud-managed Capgo deployments on vulnerable versions.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is the vendor-released patch resolving the unvalidated redirect. The fix details are documented in the GitHub Security Advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-24q8-ghqq-m8cj and the VulnCheck advisory at https://www.vulncheck.com/advisories/capgo-open-redirect-via-confirmation-url-parameter. For operators who cannot patch immediately, configure a reverse proxy or WAF rule to reject any confirm-signup requests where the confirmation_url parameter value does not match your application's registered domain - note this workaround may break legitimate cross-domain redirect flows if any exist in your deployment. As a secondary control, notify users to verify that confirmation link destinations match your application's domain before clicking; this is low-friction user guidance that reduces phishing success even before patching.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today