by Kastro
Paper/Archive/CVE-2026-56073

CVE-2026-56073

Cap-go capgo — Cap-go - OTP Bypass via Response Manipulation in Email Verification

EPSS 0.2%public exploitCVSS 9.4
critical.is priorityof 100
41
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 13.8.138 × 202.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

Affected

ProductAffectedFixed inSource
capgo< 12.128.212.128.2CNA

Scores by source

VulnCheck (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4writeupvulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification