CVE-2026-56234: Capgo Unauthenticated Password Validation Vulnerability – MEDIUM Severity

Technical summary

The vulnerability exists in Capgo's POST /functions/v1/private/validate_password_compliance endpoint, which despite its 'private' naming, is accessible to unauthenticated callers presenting only a public Supabase API key. The endpoint implements insufficient access controls (CWE-307: Improper Restriction of Rendered UI Layers or Frames) and operates with a permissive CORS policy using wildcard origin allowance. The absence of rate limiting enables attackers to conduct large-scale password spraying and credential stuffing operations. The endpoint's design suggests it was intended for internal or authenticated use but lacks the enforcement mechanisms to restrict access appropriately.

Business impact

Account compromise via credential stuffing represents a material risk to end-user trust and data confidentiality. Attackers gaining access to user accounts can steal personal information, modify account settings, or use compromised accounts as a pivot point for further attacks. For Capgo as a service provider, a widespread compromise event could result in reputational damage, regulatory scrutiny under data protection frameworks, and potential liability for inadequate access controls on authentication-critical endpoints. Organizations relying on Capgo should treat any potential compromise as a data breach requiring user notification and credential reset procedures.

Affected systems

Capgo versions before 12.128.2 are affected. The vulnerability exists in a backend validation endpoint and affects any deployment running a vulnerable version that exposes the /functions/v1/private/validate_password_compliance endpoint over the network. All users of Capgo prior to version 12.128.2 are potentially at risk.

Exploitability

Exploitability is straightforward. An attacker requires only network access to the Capgo deployment and a list of usernames or email addresses; the public Supabase key is often discoverable through browser inspection or API documentation. No special tools or bypasses are needed—standard HTTP requests to the endpoint suffice. The lack of rate limiting means the attacker can make thousands of requests without triggering protective measures, making large-scale attacks feasible. The CVSS 3.1 score of 5.3 (MEDIUM) reflects low attack complexity, no authentication requirement, and direct network accessibility, though confidentiality impact is limited to password information rather than full system compromise.

Remediation

Upgrade Capgo to version 12.128.2 or later, which addresses this vulnerability. During upgrade planning, assume that passwords of any user who may have been targeted during the vulnerability window have been exposed. Establish a post-incident password reset policy for affected users. Independently verify the absence of suspicious account access in logs during the vulnerability window. Organizations should also audit their use of Capgo to confirm they are running the patched version and review any custom integrations that may rely on the affected endpoint.

Patch guidance

Apply Capgo version 12.128.2 or a later release. The patch should restore proper authentication checks on the validate_password_compliance endpoint and implement rate limiting to prevent abuse. Verify against the official Capgo advisory that the patched version correctly requires authentication and enforces appropriate access controls. Test the patch in a non-production environment first to confirm compatibility with your deployment configuration and any dependent systems.

Detection guidance

Monitor logs for unusual patterns of requests to POST /functions/v1/private/validate_password_compliance, particularly those originating from external networks or non-standard clients. High request volumes from a single source, unusual user-agent strings, or requests without proper authentication context may indicate credential stuffing attempts. Implement alerting on failed password validation attempts that exceed baseline thresholds. Search historical logs for evidence of exploitation during the window between the vulnerability's introduction and your patching date. A spike in account lockouts, password reset requests, or unauthorized login notifications may also signal active exploitation.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized for rapid patching because credential stuffing poses immediate, ongoing risk to user account security. The low barrier to exploitation—unauthenticated, no rate limiting—means attacks can begin immediately and at scale. Organizations should treat this as a high-urgency security issue despite the moderate CVSS score, because the business and user impact of widespread account compromise far exceeds what the CVSS number alone conveys. This is especially critical if your organization manages sensitive user data or integrations with high-value systems.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability requiring no authentication and no user interaction, accessible to any attacker. The score appropriately captures the low technical barriers to exploitation. However, the 'MEDIUM' designation may understate business risk in contexts where user account compromise is highly damaging. The score assumes impact limited to confidentiality of password information; in practice, account takeover can enable further unauthorized actions. Security teams should overlay business context—the value of compromised accounts, the sensitivity of data they can access, and the scale of the user base—when deciding remediation urgency.

Frequently asked questions