Executive brief
Capgo, a platform for managing app updates and authentication, experienced a flaw in its security enrollment process. Legitimate users were unable to enable two-factor authentication (2FA) because the system's email verification service consistently failed. This prevents users from strengthening their account security, potentially leaving them more vulnerable to unauthorized access if their primary passwords are compromised.
Technical details
A denial of service (DoS) vulnerability exists in the Capgo Console's integration with Supabase Auth, specifically affecting the /auth/v1/otp endpoint. The root cause is an improper handling of captcha validation during the 2FA enrollment process, where the backend consistently returns an HTTP 500 'captcha verification process failed' error. This occurs even for authenticated, legitimate users across clean sessions. While it does not allow for data exfiltration, it effectively blocks the 'Send verification code' functionality, preventing users from completing 2FA setup and weakening the overall security posture. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD