Executive brief
Capgo, a tool used for managing app updates and billing, contains a security flaw in its payment processing components. An attacker can create deceptive links that appear to lead to official billing pages but instead redirect users to malicious websites after a payment or session is completed. This could be used in phishing campaigns to trick employees into providing login credentials or sensitive information on a fake site that looks like a legitimate part of the company's workflow.
Technical details
An open redirect vulnerability (CWE-601) exists in Capgo's Stripe integration endpoints, specifically within the stripe_portal and stripe_checkout functions. The backend fails to validate the callbackUrl, successUrl, and cancelUrl parameters against an allowlist before passing them to Stripe's API as return URLs. An authenticated attacker with 'org.update_billing' permissions can supply arbitrary external domains in these parameters. When a victim interacts with the resulting Stripe-hosted billing page and completes or cancels an action, they are automatically redirected to the attacker-controlled URL. This flaw facilitates high-trust phishing and credential harvesting by leveraging the legitimate Stripe/Capgo domain context. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-20: disclosed: NVD publication date