CVE-2026-56330: Capgo Open Redirect in Billing Endpoints – Phishing Risk

Technical summary

CVE-2026-56330 is an open redirect vulnerability (CWE-601) affecting Capgo's stripe_portal and stripe_checkout endpoints. These endpoints accept callbackUrl, successUrl, and cancelUrl parameters without proper validation or URL allowlist enforcement. An authenticated attacker can supply arbitrary URLs in these parameters, causing the application to redirect users to attacker-controlled domains. The CVSS 3.1 score of 3.5 reflects the requirement for prior authentication (PR:L) and user interaction (UI:R), limiting the attack surface but not eliminating the phishing threat vector.

Business impact

Open redirects in billing workflows create targeted phishing opportunities. Users expecting to complete legitimate Stripe transactions may be redirected to credential-harvesting clones, risking compromise of financial or account credentials. For organizations using Capgo to manage billing, this could undermine trust in the payment flow and create support burden if users report suspicious redirects. The LOW severity rating should not diminish vigilance if Capgo is customer-facing or used in sensitive financial processes.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. The stripe_portal and stripe_checkout endpoints are specifically at risk. No evidence of broader ecosystem impact is documented. Organizations running Capgo should verify their installed version against 12.128.2 as the fixed baseline.

Exploitability

Exploitation is limited by two factors: an attacker must possess valid Capgo credentials, and the victim must click a malicious link containing the crafted URL parameters. This is not a wormable or self-propagating vulnerability. Attack success depends on social engineering to convince a user to click a link that appears legitimate. The LOW severity reflects this practical friction, though phishing campaigns targeting billing workflows have historically achieved high click-through rates.

Remediation

Upgrade Capgo to version 12.128.2 or later. This release addresses the open redirect by validating and restricting the callbackUrl, successUrl, and cancelUrl parameters. Organizations unable to patch immediately should consider restricting Capgo access to trusted internal users only and monitor billing workflows for suspicious redirects. Code review of custom integrations using these endpoints is recommended.

Patch guidance

Capgo 12.128.2 or later contains the fix. Before upgrading, verify compatibility with your deployment and test in a non-production environment. Check the official Capgo release notes at the vendor advisory to confirm remediation scope and any related changes. Apply patches during a maintenance window if billing operations are continuous.

Detection guidance

Monitor for HTTP 302 or 3xx redirects from stripe_portal and stripe_checkout endpoints that contain external domains in the Location header. Log and inspect the source callbackUrl, successUrl, and cancelUrl parameter values for signs of attacker-supplied domains. Review access logs for authenticated sessions making multiple requests to these endpoints with varying URL parameters. Implement URL validation rules in your Web Application Firewall to block redirects to non-whitelisted domains.

Why prioritize this

Although rated LOW severity, this vulnerability should be prioritized if Capgo is customer-facing, processes high transaction volumes, or exists in a compliance-sensitive environment. The phishing vector is practical and leverages legitimate billing workflows, making it attractive for targeted attacks. Organizations in financial services, SaaS, or subscription-based business models should patch promptly.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW) reflects the dual requirement for authentication and user interaction, which significantly constrains the attack surface. However, this score does not account for the reputational and financial damage from phishing success in a billing context. Risk should be elevated for customer-facing deployments or organizations with high-value user bases.

Frequently asked questions