CVE-2026-56237 Details

A broken authentication vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability arises from the API key generation process, which exposes API keys in frontend requests. The backend fails to properly validate that these keys are securely generated and linked to the authenticated user. As a result, an attacker can manipulate the API key parameter in the generation request, introducing arbitrary values and creating custom API keys without authorization. This exploitation can lead to unauthorized access to protected endpoints.

API keys should be generated exclusively on the server side using secure random methods. They must not be exposed in frontend requests and should be strictly bound to authenticated user accounts. It's essential to validate key ownership with every API request, rotate and revoke any exposed keys immediately, and monitor for suspicious key generation activities.