Is CVE-2026-88861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88861 being exploited in the wild.

How severe is CVE-2026-88861?

High severity, with a CVSS score of 8.3, published 10 September 2026.

Is there a fix for CVE-2026-88861?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88861 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-88861?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88861: Capgo authentication bypass in Edge authorization via AAL1 session

CVE-2026-88861 · Severity: high · CVSS 8.3 · Published 2026-09-10

Capgo is a mobile application deployment and updates platform. An authentication flaw allows attackers who know only a user's password to bypass enrolled multi-factor authentication (MFA), create persistent API keys, and modify production application configurations even after the initial password session expires. This defeats the intended security protection of MFA and enables long-term unauthorized access to production systems.

Quick answers

Is CVE-2026-88861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88861 being exploited in the wild.
How severe is CVE-2026-88861?: High severity, with a CVSS score of 8.3, published 10 September 2026.
Which products and versions are affected?: Cap-go Capgo all versions.
Is there a fix for CVE-2026-88861?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88861 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-88861?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in Capgo's Edge authorization path caused by inconsistent MFA validation. The Edge JWT middleware (foundJWT()) accepts password-only aal1 sessions without validating the assurance level, and the direct RBAC authorization path (checkPermission()/checkPermissionPg()) authorizes users by ID without checking the JWT's aal claim. This differs from Capgo's canonical MFA control (public.verify_mfa()), which correctly requires aal2 for accounts with enrolled MFA factors. An attacker with a victim's password can authenticate with aal1, mint a persistent app-scoped app_admin API key before the session expires, and perform privileged operations such as modifying production OTA channel configurations. The key remains valid even after the aal1 session is logged out. No patch is available as of publication; all versions are affected.

Affected products

Cap-go Capgo all versions

Timeline

2026-09-10: disclosed: Vulnerability disclosed; no patched version available at time of publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.