CVE-2026-56237: Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper authorization, which can lead to unauthorized access to protected endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56237?
The severity of CVE-2026-56237 is rated as critical with a score of 9.1.
How do I fix CVE-2026-56237?
To fix CVE-2026-56237, update to a version of Capgo that is 12.128.2 or later, which includes the patch for the broken authentication vulnerability.
What does CVE-2026-56237 vulnerability involve?
CVE-2026-56237 involves unauthenticated API key generation due to client-side parameter manipulation, allowing attackers to forge API keys.
Who is affected by CVE-2026-56237?
Users of Capgo versions prior to 12.128.2 are affected by CVE-2026-56237, as they may be exposed to unauthorized API access.
What are the consequences of CVE-2026-56237?
The consequences of CVE-2026-56237 include potential unauthorized access to sensitive data and features due to improperly validated API keys.