CVE-2026-56224 Details
Description
Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.
A vulnerability exists in Capgo versions prior to 12.128.2, where the application automatically authenticates users by accepting access tokens and refresh tokens via URL query parameters. This behavior allows attackers to create malicious links that, when clicked by victims, force them into sessions controlled by the attacker. The vulnerability also poses a risk of token exposure, as tokens in query parameters can be logged in browser history and other records.
Users are advised not to accept authentication tokens via query parameters. Instead, use standard provider flows that utilize URL fragments, and immediately clear the fragment after processing. Token handling should be linked to a unique state or nonce, requiring explicit user confirmation before establishing a session with URL-provided tokens.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-83f5-439g-pwmj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-83f5-439g-pwmj | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-login-csrf-and-session-fixation-via-url-query-parameters | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-384 | Session Fixation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |