CVE-2026-56073: Cap-go Auth Bypass Vulnerability

CVE-2026-56073 Overview

Cap-go versions before 12.128.2 contain an authentication bypass vulnerability in the One-Time Password (OTP) verification flow. Attackers intercept OTP verification requests and modify the server response to falsely indicate successful email verification. This response manipulation enables unauthorized two-factor authentication (2FA) enablement and full account takeover. The flaw is tracked under CWE-345: Insufficient Verification of Data Authenticity and stems from client-side trust in unauthenticated server responses.

Critical Impact
Remote, unauthenticated attackers bypass email verification to take over Cap-go accounts and enable 2FA on victim accounts without possessing the OTP code.

Affected Products

Cap-go (capgo) versions prior to 12.128.2
Self-hosted Cap-go deployments relying on email OTP verification
Applications integrating the affected Cap-go authentication flow

Discovery Timeline

2026-06-19 - CVE-2026-56073 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in the NVD database

Technical Details for CVE-2026-56073

Vulnerability Analysis

The vulnerability resides in the OTP verification logic used during email confirmation in Cap-go. The client trusts the success indicator returned in the HTTP response from the verification endpoint. An attacker positioned to intercept and rewrite that response can flip the verification state to successful without supplying a valid OTP. Once the client accepts the falsified response, the authentication flow proceeds as if the user proved control of the email address. This enables enabling 2FA on accounts the attacker does not own, locking out legitimate users and persisting access. The issue is fixed in Cap-go 12.128.2, which enforces server-authoritative verification.

Root Cause

The root cause is improper trust in client-observable response data. The application treats a response field as the source of truth for verification status instead of validating the OTP server-side and binding the result to an authenticated session token. This mismatch falls squarely within CWE-345, insufficient verification of data authenticity.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker uses a proxy or modified client to submit an OTP verification request with arbitrary or incorrect codes. The attacker then rewrites the HTTP response body or status to indicate success. The Cap-go client accepts the manipulated response and continues the flow, enabling 2FA setup or account binding to the attacker. Full technical context is available in the GitHub Security Advisory GHSA-x2gq-85v8-j9v4 and the VulnCheck Advisory on OTP Bypass.

No verified public proof-of-concept code is available. The exploitation pattern involves a standard intercepting proxy modifying the JSON response field that signals verification success before it reaches the client.

Detection Methods for CVE-2026-56073

Indicators of Compromise

Successful email verification events without a matching valid OTP issuance and consumption record on the server.
2FA enablement events occurring shortly after multiple failed or anomalous OTP submissions from the same client.
Account email or 2FA changes originating from IP addresses or user agents inconsistent with the account owner's history.

Detection Strategies

Reconcile client-reported verification outcomes with server-side OTP state to surface mismatches.
Alert on 2FA enrollment immediately following OTP verification attempts that the server logged as failed or unmatched.
Hunt for proxy tooling fingerprints (e.g., Burp, mitmproxy user agents, anomalous TLS JA3 hashes) hitting OTP endpoints.

Monitoring Recommendations

Centralize authentication and OTP endpoint logs and retain request and response status codes for correlation.
Monitor for spikes in OTP verification calls per source IP and per account identifier.
Track 2FA enrollment, email-change, and session-creation events in an audit pipeline to enable rapid takeover investigation.

How to Mitigate CVE-2026-56073

Immediate Actions Required

Upgrade Cap-go to version 12.128.2 or later across all production and staging environments.
Audit recent OTP verification and 2FA enrollment events for anomalies and revoke sessions tied to suspicious enrollments.
Force re-verification of email addresses and reset 2FA on accounts where takeover indicators are found.

Patch Information

Cap-go addressed the vulnerability in version 12.128.2. The fix enforces server-authoritative OTP verification so the verification outcome cannot be controlled by manipulating the HTTP response. Refer to the GitHub Security Advisory GHSA-x2gq-85v8-j9v4 for the fix commit and upgrade guidance.

Workarounds

Restrict access to OTP and 2FA enrollment endpoints behind additional server-side checks such as session binding and rate limiting until the patch is deployed.
Require a freshly issued, server-signed verification token for 2FA enablement instead of relying on a client-asserted success flag.
Temporarily disable self-service 2FA enablement for high-value accounts until upgrade to 12.128.2 is complete.

bash

# Configuration example: upgrade Cap-go to the patched release
npm install @capgo/capgo@^12.128.2
# Verify the installed version
npm ls @capgo/capgo