CVE-2026-56294: Capacitor Native Biometric Authentication Bypass (v12.128.2)

Technical summary

CVE-2026-56294 is an authentication bypass in capacitor-native-biometric versions prior to 12.128.2. The vulnerability stems from insufficient validation in the onAuthenticationSucceeded() callback method, which fails to verify CryptoObject parameters passed during the biometric authentication flow. Attackers leveraging dynamic instrumentation frameworks can hook or intercept this function and bypass the authentication check without presenting valid biometric data. This is classified as an improper authentication issue (CWE-287) with a CVSS 3.1 score of 4.8 (MEDIUM severity). The attack vector is physical (AV:P), indicating the attacker must have some level of device access or code execution capability.

Business impact

Applications relying on capacitor-native-biometric for authentication face direct compromise of user identity verification. Depending on deployment context, this could allow attackers to impersonate legitimate users, access sensitive personal or financial data, manipulate user accounts, or perform actions on behalf of compromised users. The impact is most acute in financial services, healthcare, and identity-management applications. Organizations should assess whether their apps use this library and, if so, evaluate the criticality of the biometric authentication pathway in their threat model.

Affected systems

Applications using capacitor-native-biometric library versions below 12.128.2 are vulnerable. This includes mobile applications built with the Capacitor framework that implement biometric (fingerprint, face recognition, iris) authentication using this plugin. The vulnerability requires the attacker to have code execution or dynamic instrumentation capability on the target device, making it primarily a concern for rooted/jailbroken devices or scenarios where the attacker has already achieved some level of device compromise.

Exploitability

Exploitation requires either physical access to a device and the ability to run dynamic instrumentation tools, or prior code execution on the target device. This is not a remote vulnerability and does not affect applications in isolation—the attacker must interact with or control the client-side runtime. While not trivially exploitable in a mass-attack scenario, it is feasible for targeted attacks against high-value users or in insider-threat scenarios. The lack of CISA KEV listing indicates this has not yet been observed in active exploitation campaigns.

Remediation

Applications must upgrade capacitor-native-biometric to version 12.128.2 or later. This patch version implements proper CryptoObject validation in the onAuthenticationSucceeded() method, restoring cryptographic integrity checks to the authentication flow. Organizations should prioritize this update in applications where biometric authentication is a primary access control, particularly those handling sensitive data or financial transactions.

Patch guidance

Update the capacitor-native-biometric dependency to version 12.128.2 or any subsequent release. Verify against the vendor advisory that the patched version explicitly addresses CryptoObject parameter validation in the authentication callback. Test the patched version thoroughly in a staging environment to ensure biometric authentication remains functional across supported device platforms (iOS/Android) before deploying to production. Consider phased rollout if the application has a large user base, to minimize support impact.

Detection guidance

Review application dependencies and dependency lock files (package-lock.json, yarn.lock, or equivalent) to identify use of capacitor-native-biometric and confirm the installed version. Monitor for dynamic instrumentation tools (such as Frida, xposed, or similar frameworks) being deployed on devices running your application—this can indicate potential exploitation attempts. Log authentication success/failure events and correlate with runtime anomalies. Implement runtime integrity checks if the platform supports them to detect code hooking or method interception attempts.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized based on your application's threat model. If biometric authentication is a primary security control—especially in financial, healthcare, or identity applications—treat this as HIGH priority for your risk context. The physical/code-execution requirement limits mass-exploitation risk but makes targeted attacks realistic. Organizations with managed mobile device programs or enterprise deployments should move this up in the patching queue.

Risk score, explained

CVSS 3.1 score of 4.8 reflects the specific attack conditions: physical or programmatic access to the device (AV:P), high technical complexity (AC:H), high confidentiality impact (C:H), and low integrity impact (I:L). No availability impact is scored because the attack targets authentication logic, not system availability. The score appropriately captures that this is a serious logic flaw but not a network-exploitable or widely-impactful vulnerability in isolation.

Frequently asked questions