Executive brief
Capgo, a platform for managing app updates, contained a security flaw in a password validation component. An attacker could use this flaw to repeatedly test large lists of stolen passwords against user accounts without being blocked or slowed down. This significantly increases the risk of unauthorized account access and data theft through automated "credential stuffing" attacks.
Technical details
A credential validation vulnerability exists in the POST /functions/v1/private/validate_password_compliance endpoint in Capgo versions prior to 12.128.2. The endpoint is accessible using only a public Supabase key and lacks authentication requirements, rate limiting, or CAPTCHA protections. Furthermore, the endpoint is CORS-permissive with a wildcard origin allowance (*), enabling browser-based automated attacks. An attacker can exploit this to perform large-scale password spraying or credential stuffing attacks by observing the 401 'invalid_credentials' response to identify valid user credentials. The issue was addressed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-17: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date