Authentication Bypass in Capgo Due to Unrestricted Password Length

Executive Summary

CVE-2026-56228 is a vulnerability in Capgo versions before 12.128.2 where an authenticated organization administrator can set an extremely large minimum password length value in the password policy configuration.

Because there is no enforcement of a maximum value on this minimum password length field, administrators can input impractically large numbers (e.g., billions or trillions of characters).

This causes all users, including administrators, to be unable to change their passwords or access the organization, resulting in an organization-wide account lockout and an application-level denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a complete denial of service for an entire organization using Capgo.

Since users cannot change their passwords or access the organization once the malicious password policy is enabled, it results in an organization-wide account lockout.

This disruption can halt productivity, prevent access to critical resources, and potentially violate service level agreements (SLAs).

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the password policy configuration in Capgo for an unusually large minimum password length value set by an authenticated organization administrator.

Since the issue involves improper input validation allowing extremely large numeric values for minimum password length, detection involves inspecting the password policy settings for values that are impractically high (e.g., billions or trillions of characters).

No specific commands are provided in the available resources, but administrators should review the password policy configuration via the Capgo administrative interface or API to identify if the minimum password length is set to an abnormally large number.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing strict maximum password length limits in the password policy configuration to prevent setting impractically large minimum password lengths.

Ensure that server-side validation is implemented to validate password policy configurations and reject extreme numeric inputs.

Administrators should review and correct any existing password policies that have excessively large minimum password length values to restore user access and prevent organization-wide lockout.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes an organization-wide account lockout by allowing an administrator to set an impractically large minimum password length, making password changes and access impossible for all users.

Such a denial of service could disrupt normal operations and access to systems that may contain sensitive or regulated data, potentially impacting compliance with standards like GDPR or HIPAA that require continuous access controls and user authentication.

However, the provided information does not explicitly state the direct effects on compliance with these regulations.

Useful 0 Not Useful 0