Executive brief
Cap-go, a platform for managing app updates and configurations, suffered from a flaw in its login and verification system. Attackers could bypass email verification and two-factor authentication (2FA) by tricking the system into thinking a one-time password (OTP) was correct. This could lead to unauthorized account takeovers, allowing malicious actors to lock legitimate users out of their accounts and access sensitive data.
Technical details
An authentication bypass vulnerability exists in Cap-go's OTP verification mechanism due to insufficient verification of data authenticity (CWE-345). The application's backend fails to strictly validate OTP results server-side, instead relying on client-side or modifiable HTTP responses to determine success. A remote, unauthenticated attacker can intercept an OTP verification request (e.g., using a proxy like Burp Suite) and modify a '403 Forbidden' response to a '200 OK' with a success message. This manipulation allows the attacker to falsely verify email addresses, enable 2FA on accounts they do not own, and achieve full account takeover. The issue is resolved in version 12.128.2.
Affected products
- Cap-go capgo < 12.128.2
Timeline
- 2026-02-05: advisory: Vendor security advisory published on GitHub
- 2026-06-19: disclosed: CVE published to NVD