CVE-2026-56237

Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation

State: Published
Severity: 9.3 Critical
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 19, 2026

Description

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper authorization, which can lead to unauthorized access to protected endpoints.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
CapgoCapgo	before 12.128.2Affected 12.128.2Not affected

References

GitHub Security Advisory (GHSA-22w2-mx2h-4fr7)vendor-advisory
VulnCheck Advisory: Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.