Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56294capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded

Medium 4.8

In plain English

A medium-severity improper authentication in capacitor-native-biometric from capacitor-native-biometric. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 85.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@capgo/capacitor-native-biometric	8.3.6	GHSA-vx5f-vmr6-32wf

Affected products (as reported)

Vendor	Product	Versions
capacitor-native-biometric	capacitor-native-biometric	0 – before 12.128.2

Weakness: CWE-287 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

GHSA Advisory GHSA-vx5f-vmr6-32wf vendor-advisory
VulnCheck Advisory: capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded third-party-advisory