Authentication Bypass in Capacitor-Native-Biometric by Cap-Go

CVE-2026-56294

What is CVE-2026-56294?

The capacitor-native-biometric product by Cap-Go prior to version 12.128.2 exhibits a vulnerability that compromises biometric authentication mechanisms. This flaw occurs when the onAuthenticationSucceeded() method fails to properly validate the CryptoObject parameters. Consequently, attackers can exploit dynamic instrumentation techniques to manipulate this function, thereby bypassing biometric authentication processes without presenting valid credentials. This undermines the security intended for user authentication and poses significant risks to sensitive information.

References