CVE-2026-56305: Capgo Authentication Bypass Vulnerability

CVE-2026-56305 Overview

CVE-2026-56305 is an authentication bypass vulnerability in Capgo versions prior to 12.128.2. The password change endpoint fails to validate the user's current password before applying a new one. An attacker who obtains temporary session access can rotate the victim's password without knowing the existing credential. This enables full account takeover and permanent lockout of legitimate users. The flaw is tracked as CWE-620: Unverified Password Change and is documented in the GitHub Security Advisory GHSA-rjr5-qxqj-cx8g.

Critical Impact
Attackers with a valid session token can change any authenticated user's password without providing the current password, resulting in permanent account takeover.

Affected Products

Capgo versions before 12.128.2
Self-hosted Capgo deployments using the vulnerable password change endpoint
Capgo-managed services running the affected server code

Discovery Timeline

2026-07-10 - CVE-2026-56305 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-56305

Vulnerability Analysis

Capgo is an open-source live update platform for Capacitor mobile applications. The password change endpoint in versions before 12.128.2 accepts a new password from an authenticated session without re-verifying the requester's identity through the current password. This design breaks the standard defense-in-depth pattern where sensitive credential changes require reauthentication.

The vulnerability is classified under CWE-620: Unverified Password Change. Any actor holding a valid session — whether obtained through session hijacking, an unattended device, a cross-site scripting payload, or a stolen token — can invoke the endpoint and permanently reset the account credential. The legitimate owner is then locked out because the original password is no longer valid.

The EPSS score at publication was 0.357%, reflecting low observed exploitation activity but a straightforward attack path once a session is obtained. Full technical details are available in the VulnCheck advisory.

Root Cause

The password change handler validates only that the request carries a valid session token. It does not require the caller to submit and match the account's existing password. This missing check violates the reauthentication requirement for sensitive state changes.

Attack Vector

The attack is remote and requires low privileges — an authenticated session on the target account. An attacker sends a crafted request to the password change endpoint containing only the new password. The server accepts the update and overwrites the credential. The attacker then authenticates with the new password and locks the original owner out.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory for endpoint-level detail.

Detection Methods for CVE-2026-56305

Indicators of Compromise

Password change API calls that succeed without a corresponding current-password verification event in application logs.
Unexpected account lockouts reported by users immediately following an active session on a shared or untrusted device.
Successful authentication from a new IP address or user agent shortly after a password change event.

Detection Strategies

Audit application logs for calls to the password change endpoint and correlate them with session origin, IP, and device fingerprint.
Alert on password change events not preceded by a recent reauthentication or step-up challenge.
Compare pre- and post-change session metadata to identify credential rotations performed from anomalous contexts.

Monitoring Recommendations

Forward authentication and account management events to a centralized logging pipeline for correlation.
Track password change frequency per account and flag accounts exceeding baseline thresholds.
Monitor for spikes in support tickets referencing account lockouts, which often signal takeover activity.

How to Mitigate CVE-2026-56305

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed deployments.
Invalidate all active sessions and force reauthentication after applying the patch.
Review recent password change events and notify users of any suspicious activity.
Reset credentials for accounts flagged as potentially compromised.

Patch Information

The fix is included in Capgo 12.128.2. The patched password change endpoint requires the current password to be submitted and validated before accepting a new value. Upgrade instructions and release notes are published in the GitHub Security Advisory GHSA-rjr5-qxqj-cx8g.

Workarounds

Restrict access to the password change endpoint behind an authenticated proxy that enforces step-up authentication.
Shorten session lifetimes and require reauthentication for account management routes until the upgrade is applied.
Enable multi-factor authentication so a hijacked session alone cannot complete the takeover chain.

bash

# Upgrade Capgo to the patched release
npm install @capgo/capgo@^12.128.2

# Or, for a self-hosted deployment using Docker
docker pull capgo/capgo:12.128.2
docker compose up -d