{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acapgocapgo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-88861"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Capgo (all versions)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Capgo"],"content_html":"\u003cp\u003eCapgo (capgo.app) contains an authentication bypass vulnerability (CVE-2026-88861) that affects all versions, as no patch is currently available. The vulnerability exists within the Edge authorization path, where the middleware fails to validate the session authentication assurance level (aal). Specifically, the \u003ccode\u003efoundJWT()\u003c/code\u003e function in the Edge JWT middleware accepts JSON Web Tokens without confirming if the session met MFA requirements. Furthermore, the internal RBAC functions (\u003ccode\u003echeckPermission()\u003c/code\u003e and \u003ccode\u003echeckPermissionPg()\u003c/code\u003e) authorize administrative actions based solely on the user ID rather than the session aal. Consequently, an attacker who acquires a victim's password can initiate an aal1 session, effectively bypassing configured MFA to perform unauthorized operations, including the creation of persistent app-scoped API keys that remain active after the initial session is terminated. This impact is significant as it allows attackers to modify production Over-The-Air (OTA) channel configurations, potentially leading to unauthorized code distribution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated or partially authenticated attacker to bypass multi-factor authentication, gain persistent administrative access, and manipulate sensitive production OTA channel configurations. This vulnerability impacts all users of the Capgo platform, as no mitigation is currently available, creating a risk of unauthorized supply chain modification if production bundles are altered by unauthorized parties.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security operations and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement strict IP-based access controls for the Capgo administrative dashboard to mitigate potential password-guessing or credential-stuffing attempts against the aal1-enabled endpoints.\u003c/li\u003e\n\u003cli\u003eAudit existing API keys for unexpected creation dates or unauthorized administrative scopes.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual modifications to production OTA channel configurations, specifically looking for changes in bundle versions originating from unknown or unauthorized administrative sessions.\u003c/li\u003e\n\u003cli\u003eEnforce hardware-backed security keys or restrict administrative access to specific managed devices if the platform allows integration with external SSO/IAM providers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T15:10:16Z","date_published":"2026-09-10T15:10:16Z","id":"https://feed.craftedsignal.io/briefs/2026-09-capgo-auth-bypass/","summary":"Capgo contains an authentication bypass vulnerability allowing attackers with a user password to ignore MFA requirements and mint persistent administrative API keys by exploiting improper session assurance level validation.","title":"Authentication Bypass in Capgo via MFA Assurance Level Validation Failure","url":"https://feed.craftedsignal.io/briefs/2026-09-capgo-auth-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-88864"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["capgo.app (all versions)"],"_cs_severities":["high"],"_cs_tags":["sso-bypass","cloud-security","api-security"],"_cs_type":"advisory","_cs_vendors":["Capgo"],"content_html":"\u003cp\u003eCapgo (capgo.app) contains a critical authorization flaw (CVE-2026-88864) stemming from improperly restricted access to the public.sso_providers table exposed via Supabase PostgREST. The vulnerability enables any user with a standard Capgo API key to perform direct write operations to this database table. By inserting a row with status set to 'active' and enforce_sso set to 'true', an attacker effectively bypasses the backend provisioning route defined in supabase/functions/_backend/private/sso/providers.ts.\u003c/p\u003e\n\u003cp\u003eThis bypass invalidates critical security controls, including the Enterprise plan entitlement checks, domain-ownership verification through DNS TXT records, and the mandatory transition from pending_verification to verified status. Consequently, the application trusts these forged entries during SSO discovery and enforcement logic, including the unauthenticated /private/sso/check-domain preflight endpoint. This allows an attacker to assert SSO enforcement for arbitrary domains, effectively hijacking the login flow for legitimate users. As of the advisory date, no patch is available for this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized assertion of SSO enforcement for arbitrary domains. This disrupts authentication services, potentially leading to denial-of-service for legitimate users who are forced into invalid SSO workflows. The vulnerability bypasses the Enterprise plan tiering, allowing unauthorized access to enterprise-grade features. No specific victim counts were reported, but the flaw affects all deployments of the capgo.app platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize monitoring for anomalous database write activity or API key usage until a vendor patch is issued.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the Supabase PostgREST interface to known-good administrative IP ranges.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized INSERT or UPDATE operations on the public.sso_providers table.\u003c/li\u003e\n\u003cli\u003eReview all existing entries in the public.sso_providers table for unexpected configurations that deviate from legitimate enterprise tenant provisioning.\u003c/li\u003e\n\u003cli\u003eImplement strict row-level security (RLS) policies within Supabase to prevent API-key-based writes to the sso_providers table.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T15:07:07Z","date_published":"2026-09-10T15:07:07Z","id":"https://feed.craftedsignal.io/briefs/2026-09-capgo-sso-bypass/","summary":"An authorization vulnerability in the public.sso_providers table of Capgo allows attackers with an ordinary API key to bypass domain verification and enforce arbitrary SSO settings, leading to authentication disruption.","title":"CVE-2026-88864 - Authorization Bypass in Capgo SSO Provisioning","url":"https://feed.craftedsignal.io/briefs/2026-09-capgo-sso-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}