CVE-2026-56332: Capgo Open Redirect in Signup Confirmation—Patch to 12.128.2

Technical summary

CVE-2026-56332 is an open redirect vulnerability (CWE-601) in Capgo's confirm-signup endpoint. The confirmation_url parameter lacks input validation, permitting attackers to inject arbitrary external URLs. When a user clicks a crafted confirmation link containing a malicious URL in the confirmation_url parameter, the application redirects them without verifying the target domain. The CVSS 3.1 score of 4.7 (Medium) reflects the requirement for user interaction and the integrity-only impact; no confidentiality or availability breach occurs directly from the redirect itself.

Business impact

Open redirects in signup workflows undermine user trust and expose organizations to reputation damage. Users may blame Capgo for delivering them to phishing pages, even though the attacker crafted the link. Additionally, attackers may harvest credentials, deploy client-side malware, or distribute malware links under the cover of a legitimate confirmation process. For service providers using Capgo, this translates to customer support burden, potential regulatory scrutiny around account security practices, and increased phishing-related incident response costs.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability is in the confirm-signup endpoint, so any Capgo deployment using that endpoint for user registration workflows is in scope. Organizations running Capgo in production should verify their installed version against 12.128.2 to determine exposure.

Exploitability

Exploitation requires user interaction: the attacker must trick a user into clicking a malicious confirmation link. This is a common social engineering vector in phishing campaigns. No authentication, special privileges, or complex setup is required on the attacker's side, making it feasible for opportunistic attackers. The attack can be executed over the network with low complexity. However, the barrier of user click-through limits the attack surface compared to network-based or authentication-bypass flaws.

Remediation

Upgrade Capgo to version 12.128.2 or later. Verify the patch version in your vendor advisory to confirm the exact release that addresses this vulnerability. Organizations unable to patch immediately should implement compensating controls: educate users about verifying sender identity and link destination before clicking confirmation emails, implement DMARC/SPF/DKIM to reduce email spoofing risk, and monitor for anomalous signup confirmation patterns that may indicate phishing attempts.

Patch guidance

Deploy Capgo version 12.128.2 or later across all affected environments. Test the patch in a non-production environment first to ensure compatibility with any custom integrations or third-party dependencies. After patching, verify that the confirm-signup endpoint properly rejects or sanitizes unexpected confirmation_url parameters. Check vendor release notes for any other fixes or breaking changes in the target version.

Detection guidance

Monitor application logs and network traffic for confirm-signup requests containing suspicious confirmation_url parameters (e.g., URLs pointing to external domains unrelated to your Capgo instance). Implement URL validation rules at the WAF or reverse-proxy layer to block redirects to known malicious or unexpected domains. Track user feedback about unexpected redirects during signup. Consider DNS query logging to identify cases where users are being directed to attacker-controlled infrastructure. Review email headers in phishing reports to spot malicious confirmation links being distributed.

Why prioritize this

Although rated Medium severity with a CVSS of 4.7, this vulnerability warrants prompt remediation because open redirects in authentication flows are trust-undermining and frequently chained with other attacks. The low complexity and low barrier to user exploitation make it attractive to phishing operators. Organizations that handle sensitive user data or operate in regulated industries should prioritize this patch. That said, it is not a critical zero-day and should not displace emergency responses to active exploits in your environment.

Risk score, explained

The CVSS 3.1 score of 4.7 (Medium) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R). The scope is changed (S:C) because the user is redirected outside the original context. Impact is limited to integrity (I:L), with no confidentiality or availability loss directly from the redirect. However, real-world risk depends on your user base's security awareness and the prevalence of this attack in the wild. Organizations with high-value targets or sophisticated adversaries may treat this as higher priority.

Frequently asked questions