CVE-2026-56224: Capgo Console Authentication Bypass via Token URL Parameters

Technical summary

The vulnerability stems from accepting authentication tokens (access_token and refresh_token) as URL query parameters with automatic session establishment. This violates secure token handling practices: sensitive credentials should never transit in URLs where they are logged by browsers, proxies, and servers. The lack of user confirmation before session activation means the authentication flow can be triggered entirely without user intent. CWE-384 (Session Fixation) applies here—an attacker can establish a known session state and trick a user into adopting it. The issue affects all Capgo console instances running versions prior to 12.128.2.

Business impact

An attacker who compromises a user's session can access all resources and operations available to that user account within the Capgo console. Depending on the target's role, this could include deployment controls, application configuration, billing information, or API key management. The token exposure in logs creates a secondary risk: tokens may persist in web server logs, browser caches, or logging aggregation systems indefinitely, extending the window in which they can be harvested and reused. For organizations using Capgo for production deployments, unauthorized console access could lead to application downtime, data exfiltration, or injection of malicious code into live services.

Affected systems

The Capgo web console (console.capgo.app/login) in versions before 12.128.2 is affected. The vendor has not published a definitive list of affected product versions in the structured advisory data; verify the exact scope against the official Capgo security advisory. Any user or organization accessing the console through a vulnerable version is at risk if exposed to a malicious link.

Exploitability

This vulnerability requires user interaction (UI:R in the CVSS vector)—an attacker must trick a victim into clicking a malicious link. No authentication is required to craft the link, and network access is trivial (AV:N, AC:L). The attack is straightforward to execute: generate a link with valid stolen or newly issued tokens and distribute it via phishing, social engineering, or injected content. However, the attacker must first obtain valid tokens, which suggests this is most dangerous when combined with other compromises or insider threats. The CVSS score of 5.4 (Medium) reflects this balance: easy to trigger once tokens are available, but not remotely exploitable in a completely unauthenticated scenario.

Remediation

Upgrade the Capgo console to version 12.128.2 or later. The patch removes support for accepting tokens as URL query parameters and enforces proper session initiation through secure, non-logged channels. Organizations should also audit their web server and proxy logs for any evidence of token parameters in URLs, invalidate any exposed tokens, and force re-authentication of all active sessions as a precautionary measure.

Patch guidance

Capgo should publish deployment instructions specific to your hosting environment (SaaS vs. self-hosted). For SaaS users, the upgrade will likely be transparent. For self-hosted deployments, follow the vendor's release notes for version 12.128.2 to ensure backward compatibility and perform testing in a non-production environment first. After upgrading, verify that the login flow no longer accepts tokens as query parameters by attempting to authenticate with a constructed URL—it should fail or redirect without establishing a session.

Detection guidance

Monitor web server access logs for GET requests to /login endpoints containing 'access_token' or 'refresh_token' in the query string. Flag any such requests as potential exploitation attempts. Check browser histories and cache on user endpoints for console.capgo.app URLs with token parameters. Review authentication logs for sessions initiated from unusual geographic locations or IP addresses coinciding with phishing campaigns or social engineering activity. Implement web application firewalls (WAF) to block or alert on requests containing token parameters in URLs to the Capgo console.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt patching because it enables account takeover with minimal attacker effort once a link is distributed, and the token exposure in logs creates a persistent secondary risk. Organizations with sensitive deployments managed through Capgo should prioritize this in their patch schedule, especially if they have reason to believe phishing or social engineering is active in their threat environment.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a vulnerability with network-accessible attack surface (AV:N) and low complexity (AC:L), requiring no privileges (PR:N) but necessitating user interaction (UI:R). The impact is confidentiality and integrity loss (C:L, I:L) on the target system without availability impact (A:N), scoped to the vulnerable component (S:U). The Medium rating acknowledges that exploitation requires user deception and prior token acquisition, limiting the immediate threat; however, the design flaw is severe enough to warrant rapid remediation.

Frequently asked questions