Critical severity · published Jun 19, 2026
CVE-2026-56073
Cap-go - OTP Bypass via Response Manipulation in Email Verification
9.4
CVSS
0.2%
EPSS
No
On KEV
Description
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
capgo · Cap-go
before 12.128.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56073
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56073
github.com
https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4
www.vulncheck.com
https://www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification
More from capgo
9.1
CVE-2026-56081
Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email
8.2
CVE-2026-56245
Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC
7.5
CVE-2026-56339
Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC
7.5
CVE-2026-56226
Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC
7.5
CVE-2026-56248
Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy