CVE-2026-56338: Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint
Published Jun 24, 2026
·Updated
Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.
Affected Software
1 affected component
Capgo Capgo<12.128.2
Event History
Jun 24, 2026
CVE Published
via MITRE·11:53 AM
Data Sourced
via MITRE·11:53 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Apr 6, 58449
Event
via NVD·09:10 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-56338?
CVE-2026-56338 has a medium severity rating of 5.3.
2
How do I fix CVE-2026-56338?
To fix CVE-2026-56338, update Capgo to version 12.128.2 or later.
3
What type of vulnerability is CVE-2026-56338?
CVE-2026-56338 is a denial of service vulnerability affecting the /auth/v1/otp endpoint.
4
What are the consequences of CVE-2026-56338?
CVE-2026-56338 prevents users from completing 2FA enrollment due to HTTP 500 errors.
5
On which endpoint does CVE-2026-56338 occur?
CVE-2026-56338 occurs on the /auth/v1/otp endpoint.