Authentication Logic Flaw in Cap-go by Cap-go

CVE-2026-56081

What is CVE-2026-56081?

Cap-go, prior to version 12.128.2, possesses a significant authentication logic flaw that permits attackers to register and seize control of an account tied to a user's email address before email verification is completed. This vulnerability enables the attacker to activate two-factor authentication (2FA) on an account that appears to belong to the victim, allowing unauthorized access to sensitive account information and modification capabilities while the legitimate user is effectively locked out under their own credentials.

References