CVE-2026-56237: Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation

Synopsis

Broken authentication in Capgo's API key generation endpoint allows an unauthenticated remote attacker to supply arbitrary values for the API key parameter in a frontend request, bypassing any server-side binding to a legitimate user session. Because the backend does not validate that generated keys are tied to an authenticated user, an attacker can mint custom API keys at will and use them to access protected endpoints. A patched-image rebuild at version 12.128.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API key generation endpoint is exposed over the network, so the attacker must be able to reach it via HTTP/HTTPS from any internet-connected location.

• AuthenticationNot required

  No account or session credential is needed; the broken authentication flaw is precisely that the backend never enforces user binding during key generation.

• Victim interactionNot required

  The attack is fully server-side; no user action such as clicking a link or opening a file is required to complete it.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to craft a standard HTTP request with an arbitrary API key value, with no race conditions or special environmental factors required.

Blast Radius

• Attacker mints arbitrary API keys that authenticate as legitimate principals, gaining access to any protected endpoint gated on API key validation.
• Attacker reads confidential data accessible to those endpoints, including user records, configuration secrets, and stored session material.
• Attacker modifies application state through write-capable endpoints, such as altering user data, updating configuration, or injecting malicious content into stored records.