Vulnerability Description
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-level policies, while the legitimate user is denied access to the account tied to their own email.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-j4cx-5pw6-5v5j
- https://www.vulncheck.com/advisories/cap-go-account-lockout-via-2fa-misconfigura
- https://github.com/Cap-go/capgo/security/advisories/GHSA-j4cx-5pw6-5v5j
FAQ
What is CVE-2026-56081?
CVE-2026-56081 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-fact...
How severe is CVE-2026-56081?
CVE-2026-56081 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-56081?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.