CVE-2026-56081: Cap-go Auth Bypass Vulnerability

CVE-2026-56081 Overview

CVE-2026-56081 is an authentication logic flaw in Cap-go versions prior to 12.128.2. The vulnerability allows an attacker to register an account using a victim's email address before the email is verified. By enabling two-factor authentication (2FA) on the pre-registered account, the attacker locks the legitimate user out of any account bound to their own email. The flaw is categorized under CWE-640: Weak Password Recovery Mechanism for Forgotten Password. The attacker retains the ability to read and modify account state and enforce organization-level policies on the squatted identity.

Critical Impact
An unauthenticated remote attacker can hijack accounts bound to victim email addresses and deny legitimate users access to their own identity within Cap-go.

Affected Products

Cap-go (capgo) versions prior to 12.128.2
Self-hosted Cap-go deployments using the affected authentication flow
Organizations relying on Cap-go for update delivery and identity binding

Discovery Timeline

2026-06-19 - CVE-2026-56081 published to the National Vulnerability Database
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56081

Vulnerability Analysis

The vulnerability stems from Cap-go treating an unverified email address as a valid identity binding during registration. An attacker can create an account using a victim's email and complete the security configuration before the legitimate owner ever attempts to register. Enabling 2FA on the pre-registered account hardens the attacker's control and prevents the rightful owner from claiming the address. The legitimate user is effectively denied access to any account tied to their own email.

Because the attacker retains full session control, they can read and modify account state. They can also enforce organization-level policies under the squatted identity, expanding the impact beyond a single user.

Root Cause

The root cause is improper sequencing of identity verification in the registration workflow. Cap-go permits sensitive account actions, including 2FA enrollment, before the email address bound to the account is verified. This breaks the trust assumption that account ownership equals email control.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker registers an account with victim@example.com, completes registration without email verification, and enables 2FA. When the victim later attempts to register or recover the account, the system reports the email as already in use, and the 2FA challenge blocks any password reset path.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-j4cx-5pw6-5v5j and the Vulncheck Advisory for additional technical context.

Detection Methods for CVE-2026-56081

Indicators of Compromise

Account registrations where 2FA is enabled on an account whose email address was never verified
User-reported inability to register or recover an account because the email is already claimed
Organization policy changes originating from accounts with unverified email addresses

Detection Strategies

Audit the user database for accounts in an unverified_email state that also have 2fa_enabled = true
Correlate registration timestamps with email-verification completion timestamps to flag accounts that bypassed verification
Review organization policy modification logs for actions taken by users whose email verification flag is false

Monitoring Recommendations

Alert on any 2FA enrollment event preceding email verification for the same account
Monitor support tickets referencing "email already in use" or account-recovery failures
Track authentication audit logs for anomalous registration spikes against corporate email domains

How to Mitigate CVE-2026-56081

Immediate Actions Required

Upgrade Cap-go to version 12.128.2 or later across all deployments
Identify and quarantine accounts with unverified emails and active 2FA pending administrative review
Force email re-verification for any account that enabled security features before the patch
Notify users whose email domains are managed by the organization to validate their account ownership

Patch Information

The fix is included in Cap-go 12.128.2. The patch enforces email verification as a prerequisite for sensitive account actions, including 2FA enrollment. Refer to the GitHub Security Advisory GHSA-j4cx-5pw6-5v5j for release details.

Workarounds

Disable 2FA enrollment in the application until users complete email verification
Require email verification at registration time before issuing a valid session token
Implement an administrative review for any account that enables 2FA without a verified email

bash

# Configuration example: upgrade Cap-go to the patched release
npm install @capgo/capgo@^12.128.2
# Verify the installed version
npm list @capgo/capgo