CVE-2026-53982: Cap-go Console DoS Vulnerability

CVE-2026-53982 Overview

CVE-2026-53982 is a denial-of-service vulnerability in Cap-go Console versions prior to 12.28.2. The flaw exists in the account deletion flow, which incorrectly associates the deletion state with a device identifier rather than the user account. When an attacker triggers account deletion while a device identifier is linked to the active session, the platform redirects the affected device or browser environment to an account-disabled page for approximately 30 days. This blocks authentication and onboarding from that device, preventing legitimate users from logging in or registering new accounts. The weakness is classified under [CWE-645: Overly Restrictive Account Lockout Mechanism].

Critical Impact
Attackers with low privileges can lock out devices from authenticating to Cap-go Console for roughly 30 days by abusing the account deletion flow.

Affected Products

Cap-go Console versions earlier than 12.28.2
Capgo self-hosted deployments using the vulnerable Supabase backend functions
Browser environments and devices linked through device identifiers to Cap-go sessions

Discovery Timeline

2026-06-12 - CVE-2026-53982 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53982

Vulnerability Analysis

The vulnerability resides in how Cap-go Console binds account deletion state to a device identifier instead of strictly to the user account being deleted. When a user initiates account deletion while a device identifier is linked to the active session, the platform persists the disabled state against the device. Subsequent authentication attempts and onboarding flows originating from that device are redirected to an account-disabled page for approximately 30 days.

The attack requires only low-privileged authenticated access, no user interaction, and is exploitable over the network. The impact is limited to availability — confidentiality and integrity are not affected — but the lockout duration makes the condition operationally severe for affected devices.

Because the lockout state is keyed on device identifier, the same browser or device cannot recover by creating a new account or signing in with a different user. This effectively prevents recovery through standard self-service flows until the timer expires or an administrator intervenes.

Root Cause

The root cause is an overly restrictive account lockout mechanism [CWE-645] in which the account-disabled marker is applied to a device identifier rather than scoped to the deleted account. The deletion workflow does not validate that the identifier should be unbound from the disabled state once the originating account is removed.

Attack Vector

An authenticated attacker with a valid low-privilege account triggers the account deletion flow while their session has a device identifier bound to it. The platform associates the deletion state with that device identifier and any environment matching the identifier is redirected to an account-disabled page for around 30 days, preventing further logins or registrations from that environment.

typescript

// Patch reference from version.ts — chore(release): 12.128.2
-export const version = '12.128.1'
+export const version = '12.128.2'

// This is automatically generated by the update-version.js script don't edit it manually

Source: GitHub Commit 6685e5f

Detection Methods for CVE-2026-53982

Indicators of Compromise

Unexpected redirects of legitimate users to the account-disabled page in Cap-go Console.
Spikes in account deletion API calls originating from low-privilege accounts.
Multiple users reporting inability to log in or register from the same browser or device.
Device identifiers persisted in a disabled state without a corresponding active account.

Detection Strategies

Audit Cap-go backend logs for repeated account deletion events tied to short-lived accounts and shared device identifiers.
Correlate device identifier values across deletion events and subsequent failed authentication attempts.
Alert on disabled-state lookups returning matches for device identifiers without an associated user account.

Monitoring Recommendations

Monitor the rate of account deletion requests per source IP and per device identifier.
Track help-desk tickets referencing the account-disabled page to surface clusters of impacted devices.
Maintain telemetry on authentication failures grouped by device identifier to identify lockout patterns.

How to Mitigate CVE-2026-53982

Immediate Actions Required

Upgrade Cap-go Console to version 12.28.2 or later as published in the GitHub Security Advisory GHSA-qmrm-qgwr-55jf.
Identify and clear any device identifiers currently stuck in a disabled state without an associated active account.
Restrict account deletion endpoints to authenticated administrative review where feasible until patching completes.

Patch Information

The vendor released the fix in Cap-go Console version 12.28.2. The corresponding repository update is recorded in GitHub Commit 6685e5f. Additional details are available in the VulnCheck Advisory.

Workarounds

Manually reset device identifier records flagged as disabled when the originating account has been removed.
Rate-limit account deletion requests per source account and per device identifier to slow abuse.
Decouple the disabled-state marker from device identifiers in custom deployments until the upstream patch is applied.

bash

# Verify deployed Cap-go Console version meets the fixed release
grep "version" supabase/functions/_backend/utils/version.ts
# Expected output: export const version = '12.128.2' or later