Executive brief
Capgo, a platform for managing app updates and deployments, suffered from a flaw in how it creates security keys for its API. An attacker could manipulate the key creation process to generate their own custom access keys without proper authorization. This could allow unauthorized individuals to access protected data, bypass payment systems for API usage, and perform administrative actions on the platform.
Technical details
A broken authentication vulnerability exists in Capgo's API key generation mechanism due to improper server-side validation and client-side exposure of key parameters. The application allows the frontend to specify the API key value during the generation request, and the backend fails to verify if the key was securely generated or bound to the requesting user. An attacker can intercept the generation request and replace the key parameter with an arbitrary value (e.g., a custom numeric string). Because the backend accepts these user-supplied values without validation, an attacker can effectively create valid, custom API keys to bypass authentication and access protected endpoints. The issue is resolved in version 12.128.2 by moving key generation entirely to the server side.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-02-10: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date