Vulnerability · Published Jun 19, 2026 · Assigned by VulnCheck

CVE-2026-56073Cap-go - OTP Bypass via Response Manipulation in Email Verification

Critical 9.4

In plain English

A critical-severity insufficient verification of data authenticity in capgo from Cap-go. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

Affected products (as reported)

Vendor	Product	Versions
Cap-go	capgo	0 – before 12.128.2

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

GHSA Advisory GHSA-x2gq-85v8-j9v4 vendor-advisory
VulnCheck Advisory: Cap-go - OTP Bypass via Response Manipulation in Email Verification third-party-advisory