CVE-2026-56305: Capgo Authentication Bypass in Password Change Endpoint

Technical summary

The vulnerability exists in Capgo's password reset endpoint, which implements insufficient authentication controls. Specifically, the endpoint fails to enforce current password verification during password change operations. This violation of the principle of "re-authentication on sensitive operations" allows a principal with an active session (PR:L in CVSS terms) to modify credentials without additional proof of identity. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no user interaction, making it trivially exploitable once session access is obtained. The weakness maps to CWE-620 (Improper Validation of Offered Credentials to Active Identity Management Systems), indicating a fundamental gap in credential lifecycle management.

Business impact

Account takeover via this vector has immediate and severe business consequences. Users can be permanently denied access to their own accounts, disrupting productivity and trust. For organizations using Capgo, a compromised account becomes a pivot point for further attacks—including data theft (confidentiality impact: High), unauthorized changes to settings or data (integrity impact: High), and potential service disruption (availability impact: Low). The reputational cost of account lockout incidents and the effort required to remediate locked-out users compounds the operational burden. In regulated environments, this may trigger compliance incidents and breach notification obligations.

Affected systems

All Capgo deployments running version 12.128.2 or earlier are affected. Organizations should inventory their Capgo instances and determine exact version numbers immediately. The vendor has not disclosed a predefined scope of affected products beyond the version boundary, so assume all deployments in the vulnerable range require remediation regardless of deployment model or configuration.

Exploitability

Exploitation requires an attacker to already possess a valid user session—either through credential compromise, session hijacking, social engineering, or malware. The barrier is not high for an attacker who has already gained initial access. Once inside, the attack is trivial: a simple password change request to the vulnerable endpoint will succeed. There is no CVSS-listed KEV status or active exploitation data provided, so treat this as a genuine threat but without confirmed in-the-wild weaponization at this time. However, the straightforward nature of the attack suggests it will be quickly discovered and exploited if left unpatched.

Remediation

Upgrade Capgo to version 12.128.2 or later as soon as possible. This version includes the authentication bypass fix. Prior to upgrading, audit session logs for suspicious password change activity, particularly changes initiated from unusual IP addresses or at odd times. Consider temporarily disabling password change functionality via application controls if an immediate upgrade is not feasible, though this is a temporary workaround only.

Patch guidance

Apply Capgo version 12.128.2 or later according to your change management process. Verify the patch version against the official Capgo release notes and checksums to confirm authenticity. Test the update in a non-production environment first to ensure compatibility with your deployment. The patch should be treated as HIGH priority for immediate staging and deployment. Document the patching date and any observed password change anomalies in your incident logs.

Detection guidance

Monitor for rapid or unusual password changes, especially those initiated from new or unfamiliar IP addresses, at unusual hours, or from administrative sessions. Review application logs for password change requests that lack corresponding user authentication events. Implement alerting on password changes followed by immediate logout or unusual account activity. Check session logs around the timestamp of any suspicious password change for signs of session compromise (e.g., multiple concurrent sessions, location anomalies). If possible, enable additional logging at the password endpoint to capture request headers and user agent information.

Why prioritize this

This vulnerability scores 8.3 (HIGH) because it requires prior authentication (limiting the initial barrier) but results in complete account compromise with high confidentiality and integrity impact. It affects all users of vulnerable Capgo versions equally. The straightforward exploitation path, combined with the severity of account takeover, makes this a top-tier remediation priority. Any organization running an older Capgo version should treat this as critical infrastructure hygiene.

Risk score, explained

The CVSS:3.1 score of 8.3 reflects: Network-accessible attack vector (AV:N) with low complexity (AC:L), requiring low privilege (PR:L) and no user interaction (UI:N). Impact assessment assigns High to both Confidentiality (full account access including all user data) and Integrity (attacker can modify account settings, data, and credentials), with Low availability impact (service remains up but user is locked out). The score accurately represents a severe but not maximum-severity vulnerability—it is worse than simple data exposure but stops short of system-wide denial of service.

Frequently asked questions