PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56332 Capgo CVE debrief

CVE-2026-56332 is a medium-severity open redirect vulnerability in Capgo before version 12.128.2. The vulnerability exists in the confirm-signup endpoint and allows attackers to redirect users to arbitrary external websites. This is possible because the confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks. Organizations using affected Capgo versions should prioritize updating to a patched version to reduce the risk of phishing attacks. The CVSS score for this vulnerability is 5.1, indicating a medium severity level.

Vendor
Capgo
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-20
Original CVE updated
2026-06-22
Advisory published
2026-06-20
Advisory updated
2026-06-22

Who should care

Security teams and administrators responsible for Capgo installations should be aware of this vulnerability. Specifically, those who manage user authentication and authorization workflows, as well as teams handling incident response and threat mitigation, should prioritize patching or mitigating this vulnerability to prevent potential phishing attacks.

Technical summary

The CVE-2026-56332 vulnerability is caused by the lack of validation in the confirmation_url parameter of the confirm-signup endpoint in Capgo before version 12.128.2. This allows attackers to construct arbitrary URLs, potentially leading to phishing attacks or credential harvesting. The vulnerability has a CVSS score of 5.1 and is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

Defensive priority

Medium priority due to potential for phishing attacks

Recommended defensive actions

  • Update Capgo to version 12.128.2 or later
  • Review and validate user input for the confirmation_url parameter
  • Implement additional security measures for user authentication and authorization workflows
  • Monitor for suspicious activity related to the confirm-signup endpoint
  • Consider implementing a web application firewall (WAF) to detect and prevent open redirect attacks

Evidence notes

The primary evidence for this vulnerability comes from the NVD and CVE.org records. The vulnerability affects Capgo versions before 12.128.2. The confirmation_url parameter in the confirm-signup endpoint is not validated, allowing for open redirect attacks. Defenders should verify the affected product version and review official advisories for more information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56332 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56332

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56332 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56332

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.