# CVE-2026-56073: Cap-go authentication bypass in OTP verification

Source: https://junglewise.ai/threats/cve-2026-56073-cap-go-authentication-bypass-in-otp-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56073 · Severity: critical · CVSS 9.4 · Published 2026-06-19

Cap-go, a platform for managing app updates and configurations, suffered from a flaw in its login and verification system. Attackers could bypass email verification and two-factor authentication (2FA) by tricking the system into thinking a one-time password (OTP) was correct. This could lead to unauthorized account takeovers, allowing malicious actors to lock legitimate users out of their accounts and access sensitive data.

## Quick answers

**Is CVE-2026-56073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56073 being exploited in the wild.

**How severe is CVE-2026-56073?** Critical severity, with a CVSS score of 9.4, published 19 June 2026.

**Which products and versions are affected?** Cap-go capgo < 12.128.2.

**Is there a fix for CVE-2026-56073?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56073 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-56073?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in Cap-go's OTP verification mechanism due to insufficient verification of data authenticity (CWE-345). The application's backend fails to strictly validate OTP results server-side, instead relying on client-side or modifiable HTTP responses to determine success. A remote, unauthenticated attacker can intercept an OTP verification request (e.g., using a proxy like Burp Suite) and modify a '403 Forbidden' response to a '200 OK' with a success message. This manipulation allows the attacker to falsely verify email addresses, enable 2FA on accounts they do not own, and achieve full account takeover. The issue is resolved in version 12.128.2.

## Affected products

- Cap-go capgo < 12.128.2

## Timeline

- 2026-02-05: advisory: Vendor security advisory published on GitHub
- 2026-06-19: disclosed: CVE published to NVD

## References

- [https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4](https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4)
- [https://www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification](https://www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification)