CVE-2026-56312: Capgo Auth Bypass Vulnerability

CVE-2026-56312 Overview

CVE-2026-56312 is an authentication flaw in Capgo versions prior to 12.128.2. The accept_invitation endpoint creates user accounts before enforcing captcha validation. Attackers can send POST requests with invalid captcha tokens to bypass bot protection. Successful exploitation allows attackers to create unwanted accounts and consume valid invite links.

The vulnerability maps to CWE-287: Improper Authentication. The flaw requires no privileges and no user interaction, and it can be exploited across the network. Impact is limited to integrity and availability of the invitation workflow.

Critical Impact
Attackers can bypass captcha protection to programmatically create accounts and exhaust invitation tokens in Capgo deployments running versions before 12.128.2.

Affected Products

Capgo versions prior to 12.128.2
Deployments using the accept_invitation endpoint
Self-hosted Capgo instances relying on captcha-gated onboarding

Discovery Timeline

2026-07-10 - CVE-2026-56312 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-56312

Vulnerability Analysis

The vulnerability resides in the accept_invitation endpoint of Capgo. The endpoint accepts an invitation payload, captcha token, and user registration data. The server processes account creation logic before the captcha token is validated against the captcha provider. This ordering defect converts captcha enforcement into a post-hoc check that never blocks the account creation side effect.

An attacker sends a POST request with an arbitrary or invalid captcha token. The server creates the associated user record and marks the invitation link as consumed. The captcha validation step later returns a failure, but the account and the invite link state have already been persisted. See the GitHub Security Advisory and the VulnCheck Advisory on Capgo for maintainer disclosure details.

Root Cause

The root cause is an ordering flaw in the request handler. Captcha validation must gate all state-changing operations. In vulnerable builds, the handler executes account creation logic on the invitation payload before invoking captcha verification. Improper authentication controls [CWE-287] allow unauthenticated automation to reach protected functionality.

Attack Vector

Exploitation requires only network access to the Capgo API and a valid invitation identifier. An attacker scripts POST requests to accept_invitation with fabricated captcha tokens and iterates across guessed or leaked invite links. Each request burns an invite link and creates an unwanted account, degrading the integrity of the onboarding workflow.

No verified public exploit code is available. The vulnerability mechanism is described in prose per available advisories.

Detection Methods for CVE-2026-56312

Indicators of Compromise

Repeated POST requests to the accept_invitation endpoint from a single source address within a short interval
Server logs showing successful account creation followed by captcha validation failures for the same request identifier
Invitation links transitioning to consumed state without corresponding legitimate user activity
Bursts of newly created accounts with no follow-up authentication or usage

Detection Strategies

Correlate application logs to flag account creation events that precede captcha validation results
Baseline normal invite acceptance rates and alert on statistical deviations
Monitor for HTTP 4xx captcha errors that coincide with new user records in the database

Monitoring Recommendations

Enable structured logging on the accept_invitation handler and forward events to a centralized SIEM
Track invitation link lifecycle events (issued, accepted, consumed) and alert on rapid consumption
Instrument captcha provider callbacks and reconcile outcomes against account creation records

How to Mitigate CVE-2026-56312

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all deployments
Audit user accounts created after the vulnerability window and disable suspicious entries
Invalidate outstanding invitation links and reissue them to legitimate recipients
Review web application firewall (WAF) rules to rate-limit the accept_invitation endpoint

Patch Information

The maintainers fixed the flaw in Capgo 12.128.2 by validating captcha tokens before executing account creation logic. Refer to the GitHub Security Advisory GHSA-whc5-fvr7-g5v3 for commit-level details and upgrade guidance.

Workarounds

Place the accept_invitation endpoint behind a WAF rule enforcing strict rate limits per source IP
Restrict access to the invitation flow using network allowlists where feasible
Rotate and shorten invite link lifetimes to reduce the window for automated abuse

bash

# Example nginx rate-limit for accept_invitation
limit_req_zone $binary_remote_addr zone=invite:10m rate=5r/m;

location /accept_invitation {
    limit_req zone=invite burst=3 nodelay;
    proxy_pass http://capgo_backend;
}