CVE-2026-56324: Capgo - Rate Limit Bypass via User-Controlled device_id Parameter

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-770

Description

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.

Affected products

Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27
https://www.vulncheck.com/advisories/capgo-rate-limit-bypass-via-user-controlled-device-id-parameter
https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27

Get alerted when CVE-2026-56324 or the next vulnerability affects your stack