CVE-2026-56073

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.4 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L                                    

Vulnerability Description

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

Vulnerability Details

Published Date

June 19, 2026

Last Modified

June 19, 2026

CWE ID

CWE-345

Source

NVD

Vendor

Cap-go

Product

capgo

External References

https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4
https://www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification

CVE-2026-56073

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment