CVE-2026-56073

Deferred Deferred - Pending Action

Authentication Bypass in Cap-go via OTP Response Manipulation

Publication date: 2026-06-19

Last updated on: 2026-06-22

Assigner: VulnCheck

Description

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-22

Generated

2026-07-10

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-08

NVD

CVE-2026-56073

EUVD

EUVD-2026-38092

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Cap-go versions before 12.128.2 and involves an authentication bypass in the OTP (One-Time Password) verification process.

Attackers can intercept OTP verification requests and manipulate the server's HTTP responses to falsely indicate that the OTP verification was successful.

This allows attackers to bypass email verification, enabling unauthorized enabling of two-factor authentication (2FA) and potentially taking over user accounts.

Impact Analysis

The vulnerability can lead to unauthorized account takeover by allowing attackers to bypass OTP email verification.

Attackers can enable 2FA on accounts without the legitimate user's consent, potentially locking out the rightful owner and gaining unauthorized access.

This compromises account security and can lead to data breaches, loss of sensitive information, and unauthorized actions performed under the victim's identity.

Hi! I’m here to help you understand CVE-2026-56073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70