Executive Summary

This vulnerability exists in Cap-go versions before 12.128.2 and involves a flaw in the authentication logic. It allows an attacker to register and control an account linked to a victim's email address before the email is verified.

By enabling two-factor authentication on this pre-registered account, the attacker can fully control the account under the victim's identity. This control includes reading and modifying the account's state and enforcing organization-level policies.

Meanwhile, the legitimate user is denied access to the account associated with their own email address.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have severe impacts including unauthorized control over an account that appears to belong to the victim.

• The attacker can read and modify the account's state.
• The attacker can enforce organization-level policies, potentially disrupting normal operations.
• The legitimate user is locked out of their own account, losing access and control.

Useful 0 Not Useful 0