Cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*

Capgo contains an authentication bypass vulnerability allowing attackers with a user password to ignore MFA requirements and mint persistent administrative API keys by exploiting improper session assurance level validation.

An authorization vulnerability in the public.sso_providers table of Capgo allows attackers with an ordinary API key to bypass domain verification and enforce arbitrary SSO settings, leading to authentication disruption.