Authentication Bypass in Capgo via MFA Assurance Level Validation Failure

Capgo (capgo.app) contains an authentication bypass vulnerability (CVE-2026-88861) that affects all versions, as no patch is currently available. The vulnerability exists within the Edge authorization path, where the middleware fails to validate the session authentication assurance level (aal). Specifically, the foundJWT() function in the Edge JWT middleware accepts JSON Web Tokens without confirming if the session met MFA requirements. Furthermore, the internal RBAC functions (checkPermission() and checkPermissionPg()) authorize administrative actions based solely on the user ID rather than the session aal. Consequently, an attacker who acquires a victim's password can initiate an aal1 session, effectively bypassing configured MFA to perform unauthorized operations, including the creation of persistent app-scoped API keys that remain active after the initial session is terminated. This impact is significant as it allows attackers to modify production Over-The-Air (OTA) channel configurations, potentially leading to unauthorized code distribution.

Impact

Successful exploitation allows an unauthenticated or partially authenticated attacker to bypass multi-factor authentication, gain persistent administrative access, and manipulate sensitive production OTA channel configurations. This vulnerability impacts all users of the Capgo platform, as no mitigation is currently available, creating a risk of unauthorized supply chain modification if production bundles are altered by unauthorized parties.

Recommendation

Prioritized actions for security operations and IT teams:

• Implement strict IP-based access controls for the Capgo administrative dashboard to mitigate potential password-guessing or credential-stuffing attempts against the aal1-enabled endpoints.
• Audit existing API keys for unexpected creation dates or unauthorized administrative scopes.
• Monitor logs for unusual modifications to production OTA channel configurations, specifically looking for changes in bundle versions originating from unknown or unauthorized administrative sessions.
• Enforce hardware-backed security keys or restrict administrative access to specific managed devices if the platform allows integration with external SSO/IAM providers.