CVE-2026-56338: Capgo 2FA Email Verification DoS Vulnerability

CVE-2026-56338 Overview

CVE-2026-56338 is a denial of service vulnerability affecting Capgo versions prior to 12.128.2. The flaw resides in the /auth/v1/otp endpoint, which handles one-time password delivery for two-factor authentication (2FA) enrollment. Captcha validation consistently fails within the backend, causing the endpoint to return HTTP 500 errors with captcha verification process failed messages. Authenticated users cannot complete email verification required for 2FA enrollment, blocking access to a core security control. The issue is categorized under CWE-703: Improper Check or Handling of Exceptional Conditions.

Critical Impact
Users are prevented from enrolling in two-factor authentication, leaving accounts dependent on single-factor authentication and reducing the overall security posture of the platform.

Affected Products

Capgo versions before 12.128.2
Capgo /auth/v1/otp authentication endpoint
Deployments relying on Capgo for 2FA email verification

Discovery Timeline

2026-06-24 - CVE-2026-56338 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56338

Vulnerability Analysis

The vulnerability stems from improper handling of captcha validation errors inside Capgo's authentication flow. When an authenticated user requests an OTP for 2FA enrollment, the backend invokes captcha verification before issuing the email token. The verification logic fails unconditionally and the exception is not handled gracefully. The endpoint returns HTTP 500 instead of degrading to a usable state or surfacing an actionable client error. Because the OTP endpoint is the only path to complete email verification, the failure blocks 2FA enrollment for all affected users. The attack vector is network-based and requires no privileges, but impact is limited to availability of the 2FA enrollment workflow.

Root Cause

The root cause is an unhandled exceptional condition in the captcha verification pipeline serving /auth/v1/otp. The service does not treat captcha failures as recoverable, nor does it provide a fallback path for legitimate authenticated users attempting to enroll in 2FA. This aligns with [CWE-703], where exceptional conditions are not properly checked or handled.

Attack Vector

Any network-reachable client invoking /auth/v1/otp triggers the failure. No authentication bypass or privilege escalation occurs. The practical outcome is denial of the 2FA enrollment workflow, leaving user accounts dependent on password-only authentication. See the GitHub Security Advisory GHSA-m53g-7gcj-x6f7 and the VulnCheck Denial of Service Advisory for additional technical context.

Detection Methods for CVE-2026-56338

Indicators of Compromise

HTTP 500 responses returned from the /auth/v1/otp endpoint during 2FA enrollment attempts.
Response bodies containing the string captcha verification process failed.
Elevated failure rates in 2FA enrollment metrics with no corresponding increase in successful OTP issuance.

Detection Strategies

Instrument application logs to flag repeated HTTP 500 responses from the /auth/v1/otp route and alert on threshold breaches.
Track the ratio of OTP requests to successful 2FA enrollments and alert when the success rate drops below baseline.
Correlate captcha provider telemetry with backend OTP issuance logs to identify systemic verification failures.

Monitoring Recommendations

Forward authentication service logs to a centralized analytics platform and create dashboards for OTP endpoint health.
Monitor user-reported issues related to 2FA enrollment and tie them to backend error signatures.
Track the running version of Capgo against the fixed release 12.128.2 to confirm patch deployment across environments.

How to Mitigate CVE-2026-56338

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later across all environments.
Validate captcha provider configuration, including API keys, secret keys, and allowed domains, before redeploying the authentication service.
Verify that authenticated users can complete the full 2FA enrollment workflow post-upgrade in a staging environment.

Patch Information

The issue is fixed in Capgo 12.128.2. Review the GitHub Security Advisory GHSA-m53g-7gcj-x6f7 for the official remediation notice and version guidance.

Workarounds

No vendor-supplied workaround eliminates the underlying captcha handling failure; upgrading is the supported fix.
Where upgrade is delayed, communicate the 2FA enrollment outage to users and enforce strong password policies and session controls.
Restrict administrative and sensitive operations behind alternative compensating controls such as IP allow-listing until 2FA enrollment is restored.

bash

# Configuration example: verify the deployed Capgo version meets the fixed release
npm list @capgo/capgo | grep capgo
# Expected output should show version 12.128.2 or later