CVE-2026-56081: Cap-go authentication flaw lets attacker control account bound to unverified email

Overview

CVE-2026-56081 affects Cap-go before version 12.128.2. According to the description, the product allows an account to be registered against an email address that has not yet been verified. The attacker can then enable two-factor authentication on that pre-registered account, which places the account under the attacker's control while the legitimate owner of the email address is denied access. The weakness is classified as CWE-640, Weak Password Recovery Mechanism.

Impact

According to the description, a successful abuse allows the attacker to read and modify the state of the account claimed under the victim's identity and to enforce organization-level policies. The legitimate user is prevented from accessing the account tied to their own email address. The VulnCheck CVSS 3.1 vector indicates network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact, with no availability impact. The CVSS 4.0 score published by VulnCheck is 9.3.

Affected products and versions

The description identifies Cap-go versions before 12.128.2 as affected. The record's structured affected and fixes fields are empty, so no further version ranges or fixed builds are confirmed by this record. Organizations should verify their deployed version against the vendor advisory linked below.

Exploitation status

CISA KEV does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The record does not include EPSS data.

Remediation and mitigation

• Review the vendor security advisory GitHub advisory GHSA-j4cx-5pw6-5v5j and the VulnCheck advisory for remediation guidance.
• Upgrade Cap-go to version 12.128.2 or later, which the description identifies as the boundary of the affected range.
• Until patched, review whether registration with unverified email addresses is possible and consider restricting account creation for domains that matter to your organization.
• Audit existing accounts whose email addresses belong to your organization for unexpected two-factor enrollment or ownership changes.

Detection guidance

• Monitor registrations and two-factor enrollment events for accounts tied to corporate email domains, especially those created before the email address was verified by its owner.
• Alert on account lockouts or support requests from users reporting that their own email address is already linked to an account they did not create.
• Correlate identity provider logs with application logs to spot accounts whose security settings changed without a matching verified owner action.

Limitations of the available information

The record does not list affected products in structured form, does not provide a fixed version beyond the description's boundary, and does not include EPSS or SSVC data. The exact technical conditions of the flaw are described only at a high level in the sources consulted, so exposure assessment should rely on the vendor advisory and internal version inventory.

Frequently asked questions

What is the core flaw in CVE-2026-56081?

According to the description, Cap-go lets an account be registered against an email address before that address is verified. This allows another party to claim the account under the victim's identity.

Is this CVE known to be exploited in the wild?

The record shows CISA KEV listed as false, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The description states that versions before 12.128.2 are affected. The structured affected field in the record is empty, so consult the vendor advisory to confirm the exact range.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.