Vulnerability · Published Jun 12, 2026 · Assigned by VulnCheck

CVE-2026-53981Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism

High 7.6

In plain English

A high-severity missing authentication in Cap-go from Cap-go. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 81.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

Affected products (as reported)

Vendor	Product	Versions
Cap-go	Cap-go	0 – before 12.128.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-w56g-jv78-hf79 vendor-advisory
https://github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e patch
https://www.vulncheck.com/advisories/cap-go-account-takeover-via-unauthenticated-email-change-mechanism third-party-advisory