Vulnerability in Cap-Go Capgo
CVE-2026-56073
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.003 (19.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Cap-Go Capgo — versions 0, 12.128.2
Weakness classification (CWE)
References
- github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4 (vendor-advisory)
- www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-ema… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-56073?
- CVE-2026-56073 is a critical-severity vulnerability in Cap-Go Capgo, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.4/10. Published 2026-06-19.
- How severe is CVE-2026-56073?
- Critical severity. CVSS v3 base score is 9.4 out of 10.