CVE-2026-56073: Cap-go - OTP Bypass via Response Manipulation in Email Verification

Synopsis

This is an authentication bypass vulnerability in Cap-go (the capgo package) affecting versions before 12.128.2. The flaw is reachable over the network with no authentication required, meaning any attacker who can intercept or proxy HTTP traffic between the client and server can manipulate OTP verification responses to make the server treat a failed check as successful. Successful exploitation enables unauthorized two-factor authentication enablement and full account takeover. A patched-image rebuild at version 12.128.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OTP verification endpoint over the network, exposing any internet-accessible or network-reachable deployment to exploitation.

• AuthenticationNot required

  No account credentials or prior authentication are needed to attempt response manipulation against the verification endpoint.

• Victim interactionNot required

  The attacker does not need any action from a legitimate user to intercept and modify the HTTP response.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental factors beyond network access.

Blast Radius

• A successful attacker bypasses email OTP verification entirely, gaining the ability to enroll unauthorized two-factor authentication methods on a target account.
• With 2FA under attacker control, the attacker can complete a full account takeover, locking out the legitimate owner and assuming their identity within the application.
• Confidentiality impact is high: the attacker gains read access to all data and resources accessible under the compromised account.
• Integrity impact is high: the attacker can modify account settings, persisted user data, and any application records the compromised account can write.