CVE-2026-56081: Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email

Synopsis

An authentication logic flaw in Cap-go (capgo) before version 12.128.2 allows a remote, unauthenticated attacker to register an account tied to a victim's email address before that email is verified, then lock the victim out by enabling two-factor authentication on the pre-registered account. The attacker can read account state, modify it, and enforce organization-level policies while the legitimate owner is denied access entirely. A patched-image rebuild at version 12.128.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the vulnerable registration endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credentials are needed; the attacker interacts with the public registration flow.

• Victim interactionNot required

  The victim does not need to click, visit, or approve anything for the attack to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental factors must be satisfied.

Blast Radius

• The attacker reads all state stored in the account registered under the victim's email, including any profile data and associated records.
• The attacker modifies account state and configuration, such as enabling two-factor authentication to lock the legitimate owner out permanently.
• The attacker enforces organization-level policies under the victim's identity, potentially affecting other members of the same organization.
• The legitimate account owner is denied access to the account tied to their own email address for as long as the attacker controls it.