CVE-2026-56224: Capgo - Login CSRF and Session Fixation via URL Query Parameters
Capgo console.capgo.app/login before 12.128.2 accepts accesstoken and refreshtoken in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
capgo console.capgo.app/loginto a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Update Capgo so that before 12.128.2 the /login endpoint no longer accepts access_token and refresh_token in URL query parameters that auto-authenticate users.
Capgo console.capgo.app/login accept access_token and refresh_token in URL query parameters = disable (require tokens via non-URL mechanism or explicit confirmation) - Compensating control
Block or sanitize inbound links that include URL query parameters containing access_token or refresh_token to prevent login CSRF/session fixation attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56224?
CVE-2026-56224 has a severity rating of medium with a score of 5.1.
How do I fix CVE-2026-56224?
To fix CVE-2026-56224, update to the latest version of Capgo that addresses the CSRF and session fixation vulnerabilities.
What are the potential impacts of CVE-2026-56224?
Exploitation of CVE-2026-56224 can lead to unauthorized account access due to session hijacking via user tokens.
How does CVE-2026-56224 exploit user sessions?
CVE-2026-56224 allows attackers to craft URLs that authenticate users automatically, potentially leading to unauthorized access.
Is user confirmation required in CVE-2026-56224?
No, CVE-2026-56224 allows automatic authentication without user confirmation, making it especially risky.