CVE-2026-56332: Capgo - Open Redirect via confirmation_url Parameter
Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmationurl parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56332?
The severity of CVE-2026-56332 is rated medium with a score of 4.7.
How do I fix CVE-2026-56332?
To fix CVE-2026-56332, update Capgo to version 12.128.2 or later which addresses the open redirect vulnerability.
What type of vulnerability is CVE-2026-56332?
CVE-2026-56332 is an open redirect vulnerability that affects the confirm-signup endpoint in Capgo.
What can attackers do with CVE-2026-56332?
Attackers can exploit CVE-2026-56332 to redirect users to arbitrary external websites for phishing or credential harvesting.
Which versions of Capgo are affected by CVE-2026-56332?
CVE-2026-56332 affects Capgo versions prior to 12.128.2.