CVE-2026-56332 Overview
CVE-2026-56332 is an open redirect vulnerability in Capgo versions before 12.128.2. The flaw resides in the confirm-signup endpoint, where the confirmation_url parameter is not validated before redirection. Attackers can craft links that appear to originate from the trusted Capgo domain but redirect users to attacker-controlled external sites. This behavior enables phishing campaigns, credential harvesting, and malware distribution by abusing the trust users place in the legitimate Capgo URL. The vulnerability is classified under [CWE-601] Open Redirect.
Critical Impact
Attackers can weaponize Capgo confirmation links to redirect victims to phishing or malware sites, undermining email trust and enabling credential theft.
Affected Products
- Capgo versions prior to 12.128.2
- The confirm-signup endpoint that processes the confirmation_url parameter
- Deployments of Capgo used for application signup confirmation flows
Discovery Timeline
- 2026-06-20 - CVE-2026-56332 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56332
Vulnerability Analysis
The vulnerability is an unvalidated redirect in the Capgo signup confirmation workflow. When a user clicks a confirmation email link, the application calls the confirm-signup endpoint, which accepts a confirmation_url parameter and issues an HTTP redirect to that destination after processing the signup. Because the endpoint does not enforce an allowlist or origin check on confirmation_url, any externally supplied URL is honored.
The issue requires user interaction. A victim must click the crafted link, but the link itself originates from a legitimate Capgo domain, defeating common URL-inspection defenses and email security filters that rely on domain reputation.
Root Cause
The root cause is missing input validation on the confirmation_url query parameter. Secure implementations restrict post-confirmation redirects to a fixed allowlist of internal paths or verify that the target host matches the application's own domain. Capgo before 12.128.2 accepts arbitrary absolute URLs, including those pointing to external attacker-controlled hosts.
Attack Vector
An attacker constructs a Capgo signup confirmation link with confirmation_url set to a phishing page. The link is delivered through email, messaging, or social engineering. Once the victim authenticates and clicks the link, Capgo processes the confirmation and redirects the browser to the attacker's site. The destination commonly mimics the Capgo login screen to harvest credentials or drops malicious payloads.
The vulnerability mechanism is described in the GitHub Security Advisory and the VulnCheck Advisory. No public proof-of-concept exploit code has been released.
Detection Methods for CVE-2026-56332
Indicators of Compromise
- Requests to the confirm-signup endpoint containing a confirmation_url parameter whose host is external to the Capgo deployment domain
- HTTP 3xx responses from Capgo with Location headers pointing to unfamiliar or recently registered domains
- User reports of being redirected to login pages on non-Capgo domains after clicking signup confirmation emails
Detection Strategies
- Inspect web server and reverse proxy logs for confirm-signup requests, parse the confirmation_url value, and flag URLs whose host does not match an approved allowlist
- Correlate outbound redirects from Capgo with downstream DNS resolutions to newly observed domains or domains with low reputation scores
- Monitor email gateways for inbound messages containing Capgo confirmation links and decode the confirmation_url parameter for analysis
Monitoring Recommendations
- Alert on any confirm-signup request where confirmation_url resolves to an IP address, uses a non-HTTPS scheme, or targets a domain outside the trusted set
- Track week-over-week volume of distinct confirmation_url host values to detect campaigns abusing the endpoint
How to Mitigate CVE-2026-56332
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which adds validation on the confirmation_url parameter
- Audit recent confirm-signup traffic for suspicious confirmation_url values and notify affected users to reset credentials if phishing redirection is suspected
- Review email templates and confirm that confirmation links generated by the application use only internal paths
Patch Information
The vulnerability is fixed in Capgo 12.128.2. Refer to the GitHub Security Advisory GHSA-24q8-ghqq-m8cj for the official patch details and the VulnCheck Advisory for additional context.
Workarounds
- If upgrading immediately is not feasible, deploy a reverse proxy or WAF rule that rejects confirm-signup requests whose confirmation_url parameter contains an external host
- Enforce a strict allowlist of permitted redirect destinations at the application gateway layer
- Educate users to verify the final destination domain before submitting credentials, especially when arriving from email links
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
