Description
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-level policies, while the legitimate user is denied access to the account tied to their own email.
Problem types
Weak Password Recovery Mechanism for Forgotten Password
Product status
Any version before 12.128.2
12.128.2 (semver)
References
github.com/.../capgo/security/advisories/GHSA-j4cx-5pw6-5v5j
github.com/.../capgo/security/advisories/GHSA-j4cx-5pw6-5v5j (GHSA Advisory GHSA-j4cx-5pw6-5v5j)
www.vulncheck.com/...fa-misconfiguration-on-unverified-email (VulnCheck Advisory: Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email)