CVE-2026-56294: Capacitor Native Biometric Auth Bypass

CVE-2026-56294 Overview

CVE-2026-56294 is an authentication bypass vulnerability in the capacitor-native-biometric plugin in versions before 12.128.2. The flaw resides in the onAuthenticationSucceeded() method, which fails to validate the CryptoObject parameter returned by the Android BiometricPrompt API. Attackers with physical access to a device can hook the callback using dynamic instrumentation frameworks such as Frida and force a successful authentication result without providing valid biometric credentials. The vulnerability is categorized under CWE-287: Improper Authentication.

Critical Impact
Local attackers with device access can bypass biometric authentication in mobile applications that rely on capacitor-native-biometric, exposing protected workflows and stored credentials.

Affected Products

capacitor-native-biometric plugin versions prior to 12.128.2
Capacitor-based mobile applications integrating native biometric authentication
Android applications consuming the vulnerable plugin

Discovery Timeline

2026-06-20 - CVE-2026-56294 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56294

Vulnerability Analysis

The capacitor-native-biometric plugin wraps Android's BiometricPrompt API to expose biometric authentication to JavaScript code running in a Capacitor WebView. When biometric verification completes, the Android framework invokes the onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) callback. Secure implementations must inspect the CryptoObject attached to the result and perform a cryptographic operation, such as signing or decrypting a key bound to user authentication, to prove the result originated from the trusted system service.

The affected plugin omits this validation. It treats any invocation of onAuthenticationSucceeded() as a positive authentication outcome and resolves the JavaScript promise accordingly. As a result, the call site cannot distinguish a legitimate biometric match from a forged callback invocation.

Root Cause

The root cause is missing validation of the CryptoObject returned in the authentication result. The plugin does not bind the authentication event to a hardware-backed key operation, breaking the chain of trust between the biometric hardware, the Android Keystore, and the application logic.

Attack Vector

Exploitation requires local, physical-class access to an unlocked or developer-enabled device, which is reflected in the CVSS attack vector. An attacker uses a dynamic instrumentation framework such as Frida or Xposed to attach to the target process and hook the onAuthenticationSucceeded() method. The hook directly invokes the callback with a crafted or null result, causing the plugin to report successful authentication to the calling application without the biometric sensor ever being triggered. See the VulnCheck Advisory on Biometric Bypass for full technical details.

Detection Methods for CVE-2026-56294

Indicators of Compromise

Presence of Frida server binaries, frida-gadget libraries, or Xposed framework artifacts on user devices.
Application logs showing biometric success events without preceding sensor activity or Keystore operations.
Unexpected loading of instrumentation libraries into the application process at runtime.

Detection Strategies

Inventory mobile applications and dependencies to identify usage of capacitor-native-biometric below version 12.128.2.
Implement runtime application self-protection (RASP) checks that detect debugger attachment, ptrace usage, and known instrumentation library names.
Validate that BiometricPrompt.AuthenticationResult.getCryptoObject() returns a usable cipher or signature and verify a server-issued challenge before granting access.

Monitoring Recommendations

Forward mobile application telemetry and authentication events to a centralized analytics or SIEM pipeline for anomaly review.
Alert on authentication success events that lack a corresponding cryptographic operation against the Android Keystore.
Track repeated biometric authentication successes from devices flagged as rooted, jailbroken, or running in developer mode.

How to Mitigate CVE-2026-56294

Immediate Actions Required

Upgrade capacitor-native-biometric to version 12.128.2 or later in all mobile application builds.
Rebuild and redistribute affected Android applications through the relevant app stores or mobile device management (MDM) channels.
Invalidate session tokens issued after biometric authentication on prior plugin versions and require re-authentication.

Patch Information

The maintainers released a fix in capacitor-native-biometric version 12.128.2. The patch enforces validation of the CryptoObject returned by BiometricPrompt and binds authentication success to a cryptographic operation against a hardware-backed Android Keystore key. Refer to the GitHub Security Advisory GHSA-vx5f-vmr6-32wf for advisory details.

Workarounds

Require a server-side cryptographic challenge signed by a biometric-bound Keystore key before authorizing sensitive operations.
Deploy root and instrumentation detection libraries and refuse to perform biometric flows on compromised devices.
Enforce step-up authentication, such as a PIN or server-issued one-time code, in addition to biometric verification for high-value actions.

bash

# Update the vulnerable dependency in a Capacitor project
npm install capacitor-native-biometric@^12.128.2
npx cap sync android