EUVD-2026-38737Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain enterprise org admin in Capgo
-
DeliveryConfigure attacker-controlled SAML IdP
-
ExploitForge SAML assertion with victim's email
-
ExecutionPOST to provision-user endpoint
-
PersistBackend merges identity into victim account
-
ImpactAuthenticate as victim and access org data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have enterprise org admin access in Capgo with the ability to configure a SAML IdP they control (the malicious IdP), and must know or guess the email address of the victim account; the vulnerable provision-user endpoint must process the forged SAML assertion and trigger the email-based account merge. Exploitation is limited to deployments where multi-tenant enterprise SSO/SAML provisioning is enabled, and to Capgo versions before 12.128.2; it does not work against single-tenant installs where only one trusted IdP exists, and no end-user interaction by the victim is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N) honestly captures the situation: network-reachable and low-complexity once the prerequisite is met, but requires high privileges (PR:H) because the attacker must already control an enterprise org and its IdP configuration. There is no EPSS, KEV listing, or POC referenced in the inputs, so this is not confirmed actively exploited and no public exploit identified at time of analysis - risk is primarily to multi-tenant Capgo deployments where any paying enterprise customer could pivot to take over accounts in other tenants. Scope/subsequent-system impact is correctly rated High because a successful merge crosses organizational boundaries. Real-world priority is high for any Capgo customer using SSO, but the PR:H barrier limits opportunistic mass exploitation; the threat model is malicious-customer / insider-tenant rather than internet-wide. |
| Exploit ScenarioDerived | An attacker signs up for a Capgo enterprise org (or compromises an existing tenant admin), configures a malicious SAML IdP under their control, and crafts an assertion stating the email address of a high-value victim in another tenant (for example a victim org's owner). They send the assertion to the provision-user endpoint, which merges the asserted identity into the victim's existing account because the email matches - giving the attacker authenticated access to the victim's account, organization, and stored data. No public PoC is referenced, but the attack is mechanically straightforward given a standard SAML toolkit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a malicious IdP to forge SAML assertions and merge arbitrary victim accounts based solely on email match. The provision-user endpoint fails to validate that the asserting SSO provider is authorized for the victim's email domain, granting full takeover of accounts, organizations, and data. No public exploit identified at time of analysis; CVSS 4.0 base is 9.3 (Critical) reflecting high impact across both vulnerable and subsequent systems.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds domain-authorization validation to the provision-user endpoint so SAML email assertions are only honored for domains the asserting IdP is authorized for; see the upstream advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-jhjh-vp9p-54fg for fix details. If immediate upgrade is not possible, restrict creation of enterprise organizations and IdP configurations to vetted customers only, audit existing IdP-to-domain mappings and revoke any IdP that asserts domains it does not legitimately own, and temporarily disable automatic account-merge-on-email behavior in the provision-user flow (trade-off: legitimate SSO onboarding will require manual admin merge). Monitor provisioning logs for SAML assertions where the asserting org's verified domains do not match the asserted email domain and alert on cross-tenant merges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a live-update and OTA delivery platform for Capacitor-based mobile applications, offering enterprise SSO via SAML. The flaw is rooted in CWE-287 (Improper Authentication): the provision-user endpoint accepts a SAML assertion from any tenant's configured IdP and uses the asserted email address as the sole key for merging into an existing account, with no check that the asserting tenant/IdP owns or is authorized for that email's domain. This is a classic multi-tenant SSO trust-boundary failure where the application trusts identity claims across tenant boundaries rather than scoping each IdP to its verified domain(s).
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Network-reachable endpoint, low complexity once IdP configured, but PR:H because attacker must be an enterprise org admin; scope changes across tenants so S:C with C:H/I:H and A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data.
Executive ViewAI
Capgo versions before 12.128.2 contain a critical SSO vulnerability enabling account and organizational takeover through forged SAML assertions when combined with enterprise org admin access and a malicious identity provider. All organizations using Capgo with enterprise single sign-on face potential compromise of user accounts, organizational settings, and sensitive data. Leadership must prioritize immediate containment and vendor coordination given the critical severity and full-control impact across affected instances.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict enterprise organization administrator role to minimum required personnel and audit current assignments; (2) Implement network-level SAML assertion validation and inspection at identity provider connection boundaries; (3) Disable Capgo enterprise SSO functionality if business operations permit; (4) Deploy comprehensive logging and real-time alerting on all account merge and organizational role change events; (5) Audit and validate the trust chain and metadata sources for all configured identity providers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Exploit-DB