Authentication Bypass Vulnerability in Capgo by Capgo

CVE-2026-88861

What is CVE-2026-88861?

The Capgo application is affected by a significant authentication bypass vulnerability that allows unauthorized access to privileged roles. This issue arises when the Edge authorization path accepts a password-only Supabase AAL1 session, enabling an attacker to exploit RBAC permissions without the need for a valid multi-factor authentication (MFA) session. The Edge JWT middleware does not validate the assurance level of the JWT, leading to unregulated authorization through direct RBAC paths. Consequently, an attacker knowing the victim's password can authenticate, obtain a persistent app-scoped API key, and perform privileged operations—even after the session is logged out. This vulnerability effectively undermines the security provided by MFA mechanisms.

References