Direct Write Access Vulnerability in Capgo's SSO Provisioning Process

CVE-2026-88864

What is CVE-2026-88864?

A significant vulnerability exists in Capgo's architecture that allows an attacker with a normal API key to manipulate the public.sso_providers table through Supabase PostgREST. By directly inserting a row with specific parameters, the attacker can bypass vital controls that regulate SSO provisioning. This includes circumventing the requirements for domain ownership verification and the controlled status transition of SSO providers. Consequently, unauthorized domains could assert SSO enforcement, leading to disruption of legitimate login processes. At present, all versions of Capgo are susceptible to this flaw, and there is no patch available to remediate the issue.

References