PT-2026-51780 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-56338

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.

Correção

Enumeração de Fraquezas

CWE-703

Identificadores relacionados

CVE-2026-56338

Produtos afetados

Cap-Go

Referências · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-m53g-7gcj-x6f7 · Aviso do Fabricante
• https://vulncheck.com/advisories/capgo-denial-of-service-in-2fa-email-verification-via-auth-v1-otp-endpoint · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56338 · Nota de Segurança