CVE-2026-56234 Overview
CVE-2026-56234 affects Capgo versions before 12.128.2. The vulnerability exists in the POST /functions/v1/private/validate_password_compliance endpoint, which validates user credentials. The endpoint is callable using only the public Supabase key and requires no authentication. It also applies a CORS wildcard origin policy and lacks rate limiting. Attackers can use it to perform password spraying and credential stuffing against Capgo user accounts. The flaw is categorized under CWE-307: Improper Restriction of Excessive Authentication Attempts.
Critical Impact
Unauthenticated remote attackers can validate arbitrary credentials at scale, leading to account compromise across Capgo deployments running versions prior to 12.128.2.
Affected Products
- Capgo versions prior to 12.128.2
- Capgo deployments exposing the validate_password_compliance Supabase function
- Self-hosted Capgo instances using the affected endpoint with public Supabase keys
Discovery Timeline
- 2026-06-23 - CVE-2026-56234 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-56234
Vulnerability Analysis
Capgo exposes a Supabase Edge Function at POST /functions/v1/private/validate_password_compliance. This endpoint accepts user credentials and returns a response indicating whether the supplied password matches the stored value. The function authorizes callers using only the public Supabase anon key, which any client-side application embeds and exposes by design.
The endpoint compounds this exposure with two additional weaknesses. First, the CORS configuration permits a wildcard origin, so any browser-based attacker can invoke it cross-origin. Second, the function lacks rate limiting or lockout logic, allowing unlimited submission attempts per account.
An attacker who collects valid usernames can submit large lists of passwords against the endpoint to identify working credentials. Reuse of credentials from prior breaches makes credential stuffing the most efficient attack path.
Root Cause
The root cause is improper restriction of excessive authentication attempts [CWE-307] combined with missing authentication on a sensitive validation endpoint. The function trusts the public anon key as a sufficient access control boundary, but that key is not a secret.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker scripts HTTP POST requests to validate_password_compliance with the publicly known Supabase anon key in the Authorization header and iterates through username and password combinations. Successful responses identify valid credentials that the attacker can then use against the primary Capgo authentication surface.
No verified public exploit code is available. Refer to the VulnCheck Advisory on Credential Validation and the GitHub Security Advisory for additional technical context.
Detection Methods for CVE-2026-56234
Indicators of Compromise
- High-volume POST requests to /functions/v1/private/validate_password_compliance from a single source IP or distributed botnet
- Repeated authentication attempts spanning many distinct usernames within a short time window
- Requests carrying the Supabase anon key as the only authorization material against the validation endpoint
- Anomalous geographic distribution of requests against the Capgo Edge Function endpoints
Detection Strategies
- Parse Supabase Edge Function logs for requests to validate_password_compliance and aggregate counts by source IP, user agent, and target username.
- Alert when request rates against the endpoint exceed a baseline threshold or when a single source iterates across more than a few accounts.
- Correlate successful validation responses with subsequent successful logins to flag credential stuffing follow-through.
Monitoring Recommendations
- Forward Supabase function logs and reverse-proxy access logs to a centralized analytics platform for retention and correlation.
- Track failed-versus-successful response ratios per source IP to identify spraying behavior.
- Monitor account login telemetry for spikes in successful logins from new devices or geographies following endpoint abuse.
How to Mitigate CVE-2026-56234
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which removes the unauthenticated access path on validate_password_compliance.
- Restrict the function to authenticated callers by validating a user JWT instead of accepting only the public anon key.
- Apply per-IP and per-account rate limiting and lockout policies at the API gateway or within the Edge Function logic.
- Force password resets for any accounts showing evidence of validation abuse.
Patch Information
Capgo 12.128.2 resolves CVE-2026-56234. Review the GitHub Security Advisory GHSA-f6v3-xv4g-79h5 for fix details and upgrade instructions.
Workarounds
- Remove or disable the validate_password_compliance endpoint until the patched version is deployed.
- Replace the wildcard CORS policy with an explicit allowlist of trusted origins.
- Place a rate-limiting reverse proxy or Web Application Firewall in front of Supabase Edge Functions to throttle abusive callers.
- Require multi-factor authentication on all Capgo user accounts to reduce the value of validated credentials.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
