CVE Intelligence
Analysis AI-assisted

CVE-2026-56073: Cap-go OTP Verification Bypass via Server Response Manipulation

Cap-go versions before 12.128.2 contain an authentication bypass in OTP verification that can let an attacker falsely complete email verification by altering server responses. According to the record, this can enable unauthorized 2FA activation and account takeover, and the CVSS 3.1 base score is 9.4 (critical).

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56073 affects Cap-go in versions before 12.128.2. The weakness is an authentication bypass in the OTP verification flow: according to the record, an attacker can alter server responses so that email verification is wrongly reported as successful. The weakness is classified as CWE-345, Insufficient Verification of Data Authenticity.

Impact

  • The record states that an attacker can falsely mark verification as successful, which may allow unauthorized 2FA enablement.
  • The record links this to account takeover.
  • The CVSS 3.1 base score is 9.4 (critical) with confidentiality and integrity impact rated high and availability impact rated low. A CVSS 4.0 score of 9.3 is also listed.

Affected products and versions

  • The affected range stated in the record is Cap-go before 12.128.2.
  • The structured affected and fixes fields in the record are empty, so product and version details rely on the description text.
  • Sources: GitHub advisory, VulnCheck advisory.

Exploitation status

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. Treat the risk as high based on severity and the nature of the flaw, not on observed attacks.

Remediation and mitigation

  • Upgrade Cap-go to version 12.128.2 or later. This version boundary comes from the description; confirm the exact fix in the vendor advisory before rollout.
  • Until patched, restrict access to OTP and email verification endpoints where possible and monitor them closely.
  • Review accounts that recently enabled 2FA or changed verification status, especially those without a clear user action.
  • Enforce verification state on the server side and avoid trusting client-side verification results.

Detection guidance

  • Review logs for OTP verification events that succeed without matching backend verification records.
  • Alert on 2FA enrollment or email verification changes that occur shortly after OTP-related requests or unusual response patterns.
  • Correlate account changes with login anomalies to surface possible account takeover.

Limitations of the available information

  • The record does not include a confirmed list of fixed versions beyond the description threshold.
  • No CISA KEV data, EPSS score or SSVC decision is available.
  • Technical details of the exploitation path are not provided here by design.
  • Sources: NVD entry.

Frequently asked questions

Which Cap-go versions are affected by CVE-2026-56073?

According to the record description, Cap-go versions before 12.128.2 are affected. The structured affected-products field is empty, so confirm the range against the vendor advisory.

Is this CVE known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. Patching should still be treated as a priority given the critical severity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.