Vulnerability · Published Jun 24, 2026 · Assigned by VulnCheck
CVE-2026-56338Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint
Medium 5.3
In plain English
A medium-severity security flaw in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 57.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.
Affected products (as reported)
Weakness: CWE-703 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-m53g-7gcj-x6f7) vendor-advisory
- VulnCheck Advisory: Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint third-party-advisory