What’s Vulnerable › Vulnerabilities

CVE-2026-56338: Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-06-25
• Weakness: CWE-703

Description

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-m53g-7gcj-x6f7
• https://www.vulncheck.com/advisories/capgo-denial-of-service-in-2fa-email-verification-via-auth-v1-otp-endpoint
• https://github.com/Cap-go/capgo/security/advisories/GHSA-m53g-7gcj-x6f7

Get alerted when CVE-2026-56338 or the next vulnerability affects your stack