CVE-2026-56330: Capgo Open Redirect Vulnerability

CVE-2026-56330 Overview

CVE-2026-56330 is an open redirect vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the stripe_portal and stripe_checkout endpoints, which accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft billing URLs that redirect users to attacker-controlled domains. The issue is tracked under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Authenticated attackers can abuse trusted Capgo billing URLs to redirect victims to phishing pages, enabling credential harvesting and social engineering against legitimate users.

Affected Products

Capgo versions prior to 12.128.2
stripe_portal endpoint accepting callbackUrl parameter
stripe_checkout endpoint accepting successUrl and cancelUrl parameters

Discovery Timeline

2026-06-20 - CVE-2026-56330 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56330

Vulnerability Analysis

The vulnerability is an open redirect that originates in Capgo's Stripe billing integration. The stripe_portal and stripe_checkout endpoints consume user-supplied URL parameters without validating their destination. Because the redirect originates from the trusted Capgo domain, victims have limited visual cues that the final destination is attacker-controlled.

Open redirects of this class are commonly chained with phishing campaigns. An attacker shares a legitimate-looking Capgo URL through email or messaging channels. After authentication or interaction, the user is forwarded to a domain that mimics the Capgo login or payment flow. The attacker then harvests credentials, session tokens, or payment data.

The vulnerability requires authentication and user interaction, which limits mass exploitation. However, it remains useful for targeted phishing against existing Capgo customers and for bypassing URL allowlists in email security gateways.

Root Cause

The root cause is missing allowlist validation on the callbackUrl, successUrl, and cancelUrl query parameters in the Stripe billing endpoints. The application trusts client-supplied destinations and issues HTTP redirects without verifying that the target URL belongs to a known-good host or scheme.

Attack Vector

An authenticated attacker constructs a Capgo billing URL containing a malicious callbackUrl, successUrl, or cancelUrl value pointing to a domain they control. The attacker distributes this URL through phishing channels. When the victim completes or cancels the Stripe flow, the application redirects the browser to the attacker's domain, where a cloned login or payment page captures credentials. Technical details are documented in the GitHub Security Advisory GHSA-grc7-98pf-h8hq and the VulnCheck Advisory on Capgo.

Detection Methods for CVE-2026-56330

Indicators of Compromise

Requests to /stripe_portal or /stripe_checkout containing callbackUrl, successUrl, or cancelUrl parameters with external or non-Capgo hostnames.
HTTP 302 responses from Capgo billing endpoints with Location headers pointing to unfamiliar domains.
User reports of unexpected redirects from Capgo billing flows to login or payment pages on unrelated domains.

Detection Strategies

Inspect web server and reverse proxy logs for billing endpoint requests with URL parameters referencing non-allowlisted hosts.
Correlate authenticated session activity against unusual Referer or post-redirect destinations originating from stripe_portal or stripe_checkout.
Deploy URL reputation checks on outbound redirects from Capgo to catch known phishing infrastructure.

Monitoring Recommendations

Alert when query parameter values for callbackUrl, successUrl, or cancelUrl contain absolute URLs to external domains.
Track anomalies in user authentication patterns following redirects from Capgo billing endpoints.
Forward Capgo application and proxy logs to a centralized analytics platform to baseline normal redirect behavior.

How to Mitigate CVE-2026-56330

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which validates redirect parameters against an allowlist.
Audit historical logs for billing endpoint requests containing external URLs in the affected parameters.
Notify users who interacted with suspicious billing links and reset credentials where credential exposure is suspected.

Patch Information

Capgo addressed the issue in version 12.128.2. The fix introduces validation of callbackUrl, successUrl, and cancelUrl parameters on the stripe_portal and stripe_checkout endpoints, restricting redirects to trusted destinations. Refer to the GitHub Security Advisory GHSA-grc7-98pf-h8hq for upgrade guidance.

Workarounds

Restrict access to the stripe_portal and stripe_checkout endpoints at the reverse proxy or web application firewall by enforcing an allowlist on redirect parameters.
Strip or rewrite callbackUrl, successUrl, and cancelUrl query parameters at the edge to ensure they reference only Capgo-controlled hostnames.
Educate users about phishing risks tied to billing URLs and encourage verification of final destinations before submitting credentials.

bash

# Example NGINX rule blocking external redirect parameters on Capgo billing endpoints
location ~ ^/(stripe_portal|stripe_checkout) {
    if ($arg_callbackUrl ~* "^https?://(?!app\.capgo\.app)") { return 400; }
    if ($arg_successUrl  ~* "^https?://(?!app\.capgo\.app)") { return 400; }
    if ($arg_cancelUrl   ~* "^https?://(?!app\.capgo\.app)") { return 400; }
    proxy_pass http://capgo_backend;
}