CVE-2026-56224: Capgo Console Auth Bypass Vulnerability

CVE-2026-56224 Overview

CVE-2026-56224 affects the Capgo console application at console.capgo.app/login in versions before 12.128.2. The login endpoint accepts access_token and refresh_token values through URL query parameters and automatically authenticates users without confirmation. Attackers craft malicious links that force victims into attacker-controlled sessions when clicked. The tokens also leak into browser history, proxy logs, and referer headers. This session fixation flaw is categorized under CWE-384.

Critical Impact
Attackers can hijack Capgo console sessions by tricking users into clicking crafted URLs, gaining low-impact confidentiality and integrity access to victim accounts.

Affected Products

Capgo console (console.capgo.app/login) before version 12.128.2

Discovery Timeline

2026-06-30 - CVE-2026-56224 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56224

Vulnerability Analysis

The Capgo console login flow trusts authentication tokens supplied via URL query parameters. When a user visits a URL containing access_token and refresh_token parameters, the application establishes an authenticated session without user confirmation. This behavior enables session fixation attacks where the attacker chooses the session identifier before the victim authenticates.

The vulnerability affects confidentiality and integrity at a limited scope. User interaction is required because the victim must click the crafted link. No privileges or prior authentication are needed to launch the attack.

Root Cause

The root cause is improper handling of session tokens in the login flow. The application accepts session credentials from URL parameters, which are inherently untrusted and persisted across many logging surfaces. Session tokens should be delivered only through secure channels such as HTTP-only cookies or POST bodies, and never established without explicit user action.

Attack Vector

An attacker generates or obtains a valid access_token and refresh_token pair tied to an account they control. The attacker then constructs a URL such as https://console.capgo.app/login?access_token=<attacker_token>&refresh_token=<attacker_refresh> and delivers it through phishing, chat, or embedded links. When the victim clicks the link, the console authenticates them into the attacker's session. Any data the victim uploads or actions they perform occur inside the attacker's account, where the attacker can later retrieve them.

The same weakness allows tokens to leak. Browser history, HTTP referer headers, proxy access logs, and shared clipboards all capture the token values. See the VulnCheck Security Advisory and GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-56224

Indicators of Compromise

Web server or CDN access logs containing access_token= or refresh_token= in the query string of /login requests to console.capgo.app.
Referer headers to third-party sites that include Capgo session tokens, indicating leaked credentials.
Multiple distinct user agents or IP addresses authenticating into the same Capgo account within a short window.

Detection Strategies

Alert on any HTTP GET request to the login endpoint that carries token parameters in the URL.
Correlate account activity where the source IP or device fingerprint changes immediately after a login initiated through a query-string token.
Inspect email and messaging security gateways for outbound or inbound URLs targeting console.capgo.app/login with token parameters.

Monitoring Recommendations

Forward Capgo audit logs and web proxy telemetry into a centralized analytics platform to identify anomalous session establishment patterns.
Monitor developer accounts for unexpected application uploads, key rotations, or configuration changes that follow a suspicious login event.
Track browser telemetry for URLs matching the vulnerable pattern within managed endpoints to identify targeted users.

How to Mitigate CVE-2026-56224

Immediate Actions Required

Upgrade the Capgo console to version 12.128.2 or later, which removes acceptance of authentication tokens from URL query parameters.
Invalidate all active Capgo sessions and rotate access_token and refresh_token values issued prior to patching.
Warn users to avoid clicking Capgo login links received from untrusted sources until confirmation of the patch rollout.

Patch Information

The maintainers addressed the flaw in Capgo console version 12.128.2. Refer to the GitHub Security Advisory GHSA-83f5-439g-pwmj for release details and remediation guidance.

Workarounds

Block or strip access_token and refresh_token query parameters at an upstream reverse proxy or web application firewall for requests destined to /login.
Enforce mandatory re-authentication with multi-factor authentication for the Capgo console until the upgrade is complete.
Educate users to inspect URLs for embedded token parameters and to report suspicious login links to the security team.

bash

# Example nginx rule to strip token query parameters at the edge
location /login {
    if ($arg_access_token != "") { return 400; }
    if ($arg_refresh_token != "") { return 400; }
    proxy_pass https://console.capgo.app;
}