Capgo EUVD-2026-38092

Exploitation requires the attacker to be able to observe and modify the HTTP response returned by Capgo's email-OTP verification endpoint to their own client - practical via a local intercepting proxy on the attacker's machine, a modified app build, or a MitM position on the network path - and an account-registration flow in which the attacker can submit an arbitrary OTP value against an email address they wish to claim. No prior authentication, no victim user interaction, and no special server configuration are needed, but exploitation is limited to deployments of Capgo on versions below 12.128.2 and is bounded by the value of the email-verified state in the specific deployment (instances that rely on additional out-of-band identity checks reduce the impact).

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L scores 9.3 and characterises this as a low-complexity, unauthenticated, network-reachable flaw with high confidentiality and integrity impact, which is consistent with an account-takeover primitive against the auth layer. EPSS data and CISA KEV status were not provided in the input, and no public exploit is identified at time of analysis, so widespread opportunistic exploitation cannot yet be evidenced - however the attack is well within reach of a motivated attacker using only an intercepting proxy, and the VulnCheck disclosure raises the floor on attacker awareness. The practical caveat the CVSS does not capture is that the attacker is typically modifying responses on their own client to falsely verify an account they are registering, so the meaningful 'victim' is the integrity of the identity-binding rather than a remote user being directly compromised mid-flight; defenders should treat this as a critical auth-bypass and prioritise the patch even without KEV listing.

An attacker registers an account in a Capgo instance using a target's email address, then submits any value to the email-OTP verification endpoint while routing their client through an intercepting proxy such as Burp or mitmproxy. They modify the server's HTTP response to indicate verification success, causing the client and downstream flows to treat the email as verified, after which the attacker enables 2FA on the captured identity and locks the legitimate owner out - feasible with publicly documented technique per the VulnCheck advisory, even though no weaponised exploit has been identified at time of analysis.