Cap-go capgo up to 12.128.1 password recovery

Summaryinfo

A vulnerability categorized as critical has been discovered in Cap-go capgo up to 12.128.1. This affects an unknown part. Such manipulation leads to password recovery. This vulnerability is documented as CVE-2026-56081. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cap-go capgo up to 12.128.1 and classified as critical. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a password recovery vulnerability. Using CWE to declare the problem leads to CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-level policies, while the legitimate user is denied access to the account tied to their own email.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-56081 since 06/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Upgrading to version 12.128.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38095). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Cap-go

Name

• capgo

Version

• 12.128.0
• 12.128.1

Website

• Product: https://github.com/Cap-go/capgo/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion