Is CVE-2026-88864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88864 being exploited in the wild.

How severe is CVE-2026-88864?

Critical severity, with a CVSS score of 9.1, published 10 September 2026.

Is there a fix for CVE-2026-88864?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88864 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88864?

Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88864: Capgo authentication bypass via PostgREST direct write to SSO providers

CVE-2026-88864 · Severity: critical · CVSS 9.1 · Published 2026-09-10

Capgo is a platform for managing and deploying mobile applications. The vulnerability allows an attacker with a standard API key to bypass security controls and create fraudulent single sign-on (SSO) providers, enabling them to force arbitrary domains to require SSO authentication without proper verification. This disrupts normal user login and could prevent legitimate users from accessing applications.

Technologies: Capgo.App. Vendors: Capgo.

Quick answers

Is CVE-2026-88864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88864 being exploited in the wild.
How severe is CVE-2026-88864?: Critical severity, with a CVSS score of 9.1, published 10 September 2026.
Which products and versions are affected?: Capgo.App all.
Is there a fix for CVE-2026-88864?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88864 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88864?: Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw (CWE-284) in Capgo's Supabase backend. The public.sso_providers table is directly writable via Supabase PostgREST using a standard API key, allowing an attacker to insert rows with status='active' and enforce_sso=true. This bypasses the intended backend SSO provisioning workflow located in supabase/functions/_backend/private/sso/providers.ts, which includes Enterprise plan checks, DNS TXT domain-ownership verification, and Supabase Management API validation. The unauthenticated login preflight endpoint /private/sso/check-domain trusts the local sso_providers table state without verifying its origin, causing it to report {"has_sso": true, "enforce_sso": true} for unverified domains. Attack requires only a valid Capgo full API key (no authentication bypass needed to obtain one) and network access to Supabase PostgREST. An attacker can disrupt login for any domain and assert control over SSO enforcement. No patch was available at the time of disclosure, affecting all versions.

Affected products

Capgo capgo.app all

Timeline

2026-09-10: disclosed
2026-08-27: advisory: GitHub security advisory GHSA-xg7v-83qv-qfff published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.