Vulnerability · Published Jun 23, 2026 · Assigned by VulnCheck

CVE-2026-56234Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint

Medium 5.3

In plain English

A medium-severity security flaw in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 65.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate limiting, enabling attackers to perform password spraying and credential stuffing attacks to compromise user accounts.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-f6v3-xv4g-79h5) vendor-advisory
VulnCheck Advisory: Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint third-party-advisory