CVE-2026-56224

Received Received - Intake

Authentication Bypass via URL Tokens in Capgo Console

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56224

EUVD

EUVD-2026-40426

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

The vulnerability exists in Capgo console.capgo.app/login versions before 12.128.2, where the application accepts access_token and refresh_token in URL query parameters and automatically authenticates users without any confirmation.

This allows attackers to craft malicious links that force victims into attacker-controlled sessions, exposing sensitive tokens in browser history and logs.

Impact Analysis

This vulnerability can lead to unauthorized access to user accounts because attackers can trick users into clicking malicious links that automatically authenticate them into attacker-controlled sessions.

Additionally, sensitive tokens are exposed in browser history and logs, increasing the risk of token theft and session hijacking.

Hi! I’m here to help you understand CVE-2026-56224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70