PT-2026-51158 · Cap Go · Cap-Go

Judel777 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56330

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An open redirect issue exists in the 'stripe portal' and 'stripe checkout' endpoints. These endpoints accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft malicious billing URLs to redirect users to attacker-controlled domains, facilitating phishing and credential harvesting.

Recommendations Update to version 12.128.2 or later. Avoid using the callbackUrl, successUrl, and cancelUrl parameters in the 'stripe portal' and 'stripe checkout' endpoints until the update is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-56330

Affected Products

Cap-Go

References · 6

• https://github.com/Cap-go/capgo/security/advisories/GHSA-grc7-98pf-h8hq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56330 · Security Note
• https://twitter.com/VulmonFeeds/status/2068411197574001114 · Twitter Post
• https://twitter.com/CVEnew/status/2068380899545141468 · Twitter Post
• https://vulncheck.com/advisories/capgo-open-redirect-via-unvalidated-stripe-billing-urls · Note
• https://twitter.com/infoflowcloud/status/2068382393304527290 · Twitter Post