CVE-2026-56234: Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint
Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validatepasswordcompliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate limiting, enabling attackers to perform password spraying and credential stuffing attacks to compromise user accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Require authenticated requests for this endpoint; disallow calls that present only the public Supabase (public) key.
Capgo POST /functions/v1/private/validate_password_compliance endpoint authentication_required = true (do not accept requests authenticated only with the public Supabase key) - Configuration
Remove wildcard CORS origin allowance and configure Access-Control-Allow-Origin to list only allowed/trusted origins.
Capgo POST /functions/v1/private/validate_password_compliance endpoint Access-Control-Allow-Origin = specific trusted origins (do not use '*') - Configuration
Implement rate limiting/throttling on this endpoint (e.g., per-IP and per-account limits) to prevent password spraying and credential stuffing.
Capgo POST /functions/v1/private/validate_password_compliance endpoint rate_limiting = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56234?
The severity of CVE-2026-56234 is medium with a score of 5.3.
How do I fix CVE-2026-56234?
To fix CVE-2026-56234, upgrade to Capgo version 12.128.2 or later, which addresses the credential validation vulnerability.
What are the potential impacts of CVE-2026-56234?
CVE-2026-56234 allows attackers to conduct password spraying attacks by exploiting the publicly accessible credential validation endpoint.
Is authentication required for CVE-2026-56234?
No, CVE-2026-56234 can be exploited without authentication as it uses only the public Supabase key.
What endpoint is affected by CVE-2026-56234?
CVE-2026-56234 affects the POST /functions/v1/private/validate_password_compliance endpoint in Capgo.