CVE-2026-88861
Deferred Deferred - Pending Action

Authentication Bypass in Capgo via Supabase JWT Middleware

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase/functions/_backend/utils/hono_middleware.ts) accepts the JWT without validating its assurance level, and the direct RBAC path (checkPermission()/checkPermissionPg() in supabase/functions/_backend/utils/rbac.ts calling public.rbac_check_permission_direct()) authorizes by user ID without passing or checking the session aal, unlike the public.verify_mfa() control which correctly requires aal2. An attacker who knows only the victim's password can therefore authenticate, mint a persistent app-scoped app_admin API key that remains valid after the aal1 session is logged out, and perform privileged operations such as modifying production OTA channel configurations (validated by changing a public production channel from bundle 1.0.0 to 1.0.1), defeating the protection provided by MFA.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88861
EUVD
EUVD-2026-75411

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo to 12.258.0 (exc)
capgo capgo to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88861 is an authentication bypass in Capgo's Edge authorization system. It allows attackers to bypass Multi-Factor Authentication (MFA) by exploiting a direct Role-Based Access Control (RBAC) path. The system accepts password-only sessions without validating the Assurance Level (AAL), enabling unauthorized privileged operations even when MFA is enabled but unused for the session.

Detection Guidance

To detect this vulnerability, inspect your Capgo Edge JWT middleware logs for sessions where AAL1 is accepted without MFA validation. Check for persistent app_admin API keys created during password-only sessions. Review RBAC logs for direct authorization paths bypassing MFA checks.

Impact Analysis

An attacker who knows only the victim's password can authenticate, mint a persistent app-scoped app_admin API key, and perform privileged operations such as modifying production OTA channel configurations. The API key remains valid even after the session is logged out, defeating MFA protection.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (e.g., unauthorized data access under Article 32) and HIPAA (e.g., impermissible access under the Security Rule). The ability to bypass MFA and perform privileged operations without proper authentication controls undermines security measures required by these regulations.

Mitigation Strategies

Upgrade to capgo-12.258.0 or later, which enforces AAL2 for privileged actions when MFA is enrolled. Disable direct RBAC authorization paths until patched. Rotate all app_admin API keys and enforce session-level MFA validation in all authorization paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88861. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart