CVE-2026-56073

critical · 9.3

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

9.3

CVSS

0.3%

EPSS (exploit prob.)

19th

EPSS percentile

2026-06-19

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-345

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4
https://www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification
https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-56073