Executive brief
Capgo, a platform for managing app updates and deployments, contains a security flaw in its signup confirmation process. An attacker can create a deceptive link that appears to be from the official Capgo domain but instead redirects the user to a malicious external website. This can be used in phishing campaigns to steal user credentials or distribute malware by exploiting the user's trust in the legitimate Capgo URL.
Technical details
An open redirect vulnerability exists in the Capgo 'confirm-signup' endpoint due to insufficient validation of the 'confirmation_url' parameter. An unauthenticated remote attacker can craft a malicious URL that, when clicked by a user, redirects them from console.capgo.app to an arbitrary third-party domain. This occurs because the application blindly trusts the parameter value without verifying if the destination belongs to an authorized domain. This flaw is primarily leveraged for phishing and credential harvesting. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-02-25: advisory: GitHub Security Advisory published
- 2026-06-20: disclosed: CVE published to NVD