CVE-2026-53982: Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association

Synopsis

This is a denial-of-service vulnerability in the account deletion flow of Cap-go Console versions before 12.28.2. An authenticated attacker can trigger account deletion while a device identifier is linked to an active session, causing the platform to incorrectly associate the deletion state with that device identifier. The affected device or browser environment is then blocked from any login or account registration for approximately 30 days. A patched-image rebuild at version 12.28.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Cap-go Console service via a standard HTTP/HTTPS connection.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must hold a valid session to initiate the account deletion flow that triggers the vulnerability.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the deletion state entirely through their own authenticated session.

• Attack complexityDetail

  Attack complexity is low; the exploit requires no special conditions, race windows, or environmental factors and can be executed reliably on any affected instance.

Blast Radius

• The affected device or browser environment is redirected to an account-disabled page for approximately 30 days, blocking all login attempts from that device.
• Any new account registration attempt from the affected device identifier is also denied for the same 30-day window, disrupting onboarding flows.
• Availability of authentication and account creation functions is fully eliminated for the targeted device, with no user-side workaround short of switching to an unaffected device or environment.