EUVD-2026-38752Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with no confirmed auth gate per vendor CVSS 4.0; impact is exclusively low availability with no confidentiality or integrity loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.
AnalysisAI
Denial of service in Capgo's /auth/v1/otp endpoint blocks email-based 2FA enrollment for authenticated users in all versions before 12.128.2. The backend captcha validation subsystem fails to handle exceptions gracefully, consistently returning HTTP 500 errors and preventing users from completing two-factor authentication setup. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the impact is security-control degradation: users cannot activate 2FA, leaving accounts with only single-factor protection.
Technical ContextAI
Capgo is a live update platform for Capacitor-based mobile applications, providing backend services including authentication flows. The vulnerable component is the /auth/v1/otp endpoint, which handles one-time password delivery as part of the 2FA enrollment flow. CWE-703 (Improper Check or Handling of Exceptional Conditions) identifies the root cause: the captcha verification subsystem raises an unhandled exception or enters a persistent failure state, and instead of gracefully degrading or surfacing a recoverable error to the client, the endpoint propagates the failure as an HTTP 500 response. This breaks the 2FA enrollment flow entirely for affected deployments. The CPE string cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all Capgo versions across all platforms prior to the fix.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the unhandled exception in the captcha verification path of the /auth/v1/otp endpoint. The vendor advisory is at https://github.com/Cap-go/capgo/security/advisories/GHSA-m53g-7gcj-x6f7. If immediate patching is not feasible, consider temporarily disabling captcha enforcement on the OTP endpoint as a compensating control - this restores 2FA enrollment at the cost of removing bot-abuse protection on that endpoint. Alternatively, restricting network-level access to /auth/v1/otp to known trusted IP ranges reduces the exposure surface while the patch is applied. Both workarounds carry trade-offs and should be treated as temporary measures only.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today