CVE-2026-56073
Cap-go - OTP Bypass via Response Manipulation in Email Verification
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 19, 2026
- Updated
- Jun 22, 2026
- Reserved
- Jun 18, 2026
Description
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.4 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | VulnCheck |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
capgoCap-go |
|
References
- GHSA Advisory GHSA-x2gq-85v8-j9v4vendor-advisory
- VulnCheck Advisory: Cap-go - OTP Bypass via Response Manipulation in Email Verificationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.