Impact

Successful exploitation allows an unauthenticated or partially authenticated attacker to bypass multi-factor authentication, gain persistent administrative access, and manipulate sensitive production OTA channel configurations. This vulnerability impacts all users of the Capgo platform, as no mitigation is currently available, creating a risk of unauthorized supply chain modification if production bundles are altered by unauthorized parties.

Recommendation

Prioritized actions for security operations and IT teams:

• Implement strict IP-based access controls for the Capgo administrative dashboard to mitigate potential password-guessing or credential-stuffing attempts against the aal1-enabled endpoints.
• Audit existing API keys for unexpected creation dates or unauthorized administrative scopes.
• Monitor logs for unusual modifications to production OTA channel configurations, specifically looking for changes in bundle versions originating from unknown or unauthorized administrative sessions.
• Enforce hardware-backed security keys or restrict administrative access to specific managed devices if the platform allows integration with external SSO/IAM providers.

This bypass invalidates critical security controls, including the Enterprise plan entitlement checks, domain-ownership verification through DNS TXT records, and the mandatory transition from pending_verification to verified status. Consequently, the application trusts these forged entries during SSO discovery and enforcement logic, including the unauthenticated /private/sso/check-domain preflight endpoint. This allows an attacker to assert SSO enforcement for arbitrary domains, effectively hijacking the login flow for legitimate users. As of the advisory date, no patch is available for this vulnerability.

Impact

Successful exploitation results in the unauthorized assertion of SSO enforcement for arbitrary domains. This disrupts authentication services, potentially leading to denial-of-service for legitimate users who are forced into invalid SSO workflows. The vulnerability bypasses the Enterprise plan tiering, allowing unauthorized access to enterprise-grade features. No specific victim counts were reported, but the flaw affects all deployments of the capgo.app platform.

Recommendation

Prioritize monitoring for anomalous database write activity or API key usage until a vendor patch is issued.

• Restrict access to the Supabase PostgREST interface to known-good administrative IP ranges.
• Audit logs for unauthorized INSERT or UPDATE operations on the public.sso_providers table.
• Review all existing entries in the public.sso_providers table for unexpected configurations that deviate from legitimate enterprise tenant provisioning.
• Implement strict row-level security (RLS) policies within Supabase to prevent API-key-based writes to the sso_providers table.