CVE-2026-53981: Cap-go Auth Bypass Vulnerability

CVE-2026-53981 Overview

CVE-2026-53981 is an account takeover vulnerability in Cap-go versions prior to 12.128.2. The flaw resides in the email change mechanism, which fails to require re-authentication such as password confirmation or multi-factor authentication (MFA) before updating the registered email address. An attacker with temporary authenticated session access can redirect verification to an attacker-controlled email address. Once the email change completes, the attacker triggers a password reset and permanently takes over the victim's account. The issue is tracked under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Attackers with brief session access can permanently hijack Cap-go accounts by changing the registered email address and performing a password reset.

Affected Products

Cap-go (capgo) versions prior to 12.128.2
Self-hosted Cap-go deployments using the affected Supabase backend functions
Cap-go cloud tenants running pre-patch releases

Discovery Timeline

2026-06-12 - CVE-2026-53981 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53981

Vulnerability Analysis

The vulnerability is a business logic flaw in Cap-go's account management workflow. The email change endpoint accepts a new email address from any caller holding a valid session token. It does not re-prompt the user to provide their current password or complete an MFA challenge. This violates the principle that security-sensitive operations require step-up authentication.

Attackers chain the missing check with the standard password reset flow. After the email is changed to an attacker-controlled inbox, a password reset request sends the recovery link to that inbox. The attacker resets the credentials and locks out the legitimate user. The original session no longer needs to remain valid once the email change is committed.

Root Cause

The root cause is [CWE-306] Missing Authentication for a Critical Function. Cap-go treated the active session as sufficient authorization for changing the primary recovery identifier. Recovery identifiers like email addresses must be protected by the same controls as password changes.

Attack Vector

Exploitation requires network access and an authenticated session at low privilege. Session access can be obtained through XSS, session fixation, shared workstations, stolen session cookies, or reuse of an unattended browser. Once authenticated, the attacker calls the email change function with an arbitrary destination address and completes verification through the attacker-controlled mailbox.

typescript

// Patch in supabase/functions/_backend/utils/version.ts
-export const version = '12.128.1'
+export const version = '12.128.2'

// This is automatically generated by the update-version.js
// script don't edit it manually

Source: Cap-go commit 6685e5f. The version bump corresponds to the release that adds re-authentication enforcement to the email change handler. Review the full diff for the backend handler changes that introduce the credential check.

Detection Methods for CVE-2026-53981

Indicators of Compromise

Email change events on accounts not preceded by a recent password prompt or MFA challenge
Password reset requests issued within minutes of a successful email address update
New recipient domains for verification emails that do not match historical user activity
Authentication sessions originating from one IP that immediately trigger account profile changes from another

Detection Strategies

Audit Cap-go authentication logs for email change API calls and correlate with the session's last successful password or MFA event
Alert when email change and password reset occur on the same account within a short time window
Flag email changes where the new domain differs from established corporate or personal domains for that user
Monitor Supabase function invocations for the email update handler in Cap-go versions older than 12.128.2

Monitoring Recommendations

Forward Cap-go and Supabase audit logs to a centralized SIEM for retention and correlation
Track the version string exposed by the version.ts endpoint to confirm patched deployments
Establish a baseline of legitimate email change frequency per account to detect anomalies

How to Mitigate CVE-2026-53981

Immediate Actions Required

Upgrade all Cap-go deployments to version 12.128.2 or later without delay
Invalidate active sessions and force re-authentication after upgrading
Audit recent email change events and notify users of any unauthorized modifications
Reset credentials for any account showing suspicious email change and password reset sequences

Patch Information

The fix is shipped in Cap-go release 12.128.2, published via the GitHub Security Advisory GHSA-w56g-jv78-hf79. The corresponding code change is in commit 6685e5f. See the VulnCheck advisory for additional context.

Workarounds

Disable the in-app email change feature until the upgrade is applied if running a self-hosted deployment
Require administrators to process email change requests manually through a verified support channel
Enforce MFA on all Cap-go accounts to raise the cost of obtaining a usable session token
Shorten session lifetimes and bind sessions to client fingerprints to reduce the window of opportunity

bash

# Verify the deployed Cap-go backend is on the patched release
grep -R "export const version" supabase/functions/_backend/utils/version.ts
# Expected output: export const version = '12.128.2'

# Upgrade the dependency in a Node project
npm install @capgo/capgo@12.128.2