{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/capgo-all-versions/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-88861"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Capgo (all versions)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Capgo"],"content_html":"\u003cp\u003eCapgo (capgo.app) contains an authentication bypass vulnerability (CVE-2026-88861) that affects all versions, as no patch is currently available. The vulnerability exists within the Edge authorization path, where the middleware fails to validate the session authentication assurance level (aal). Specifically, the \u003ccode\u003efoundJWT()\u003c/code\u003e function in the Edge JWT middleware accepts JSON Web Tokens without confirming if the session met MFA requirements. Furthermore, the internal RBAC functions (\u003ccode\u003echeckPermission()\u003c/code\u003e and \u003ccode\u003echeckPermissionPg()\u003c/code\u003e) authorize administrative actions based solely on the user ID rather than the session aal. Consequently, an attacker who acquires a victim's password can initiate an aal1 session, effectively bypassing configured MFA to perform unauthorized operations, including the creation of persistent app-scoped API keys that remain active after the initial session is terminated. This impact is significant as it allows attackers to modify production Over-The-Air (OTA) channel configurations, potentially leading to unauthorized code distribution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated or partially authenticated attacker to bypass multi-factor authentication, gain persistent administrative access, and manipulate sensitive production OTA channel configurations. This vulnerability impacts all users of the Capgo platform, as no mitigation is currently available, creating a risk of unauthorized supply chain modification if production bundles are altered by unauthorized parties.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security operations and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement strict IP-based access controls for the Capgo administrative dashboard to mitigate potential password-guessing or credential-stuffing attempts against the aal1-enabled endpoints.\u003c/li\u003e\n\u003cli\u003eAudit existing API keys for unexpected creation dates or unauthorized administrative scopes.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual modifications to production OTA channel configurations, specifically looking for changes in bundle versions originating from unknown or unauthorized administrative sessions.\u003c/li\u003e\n\u003cli\u003eEnforce hardware-backed security keys or restrict administrative access to specific managed devices if the platform allows integration with external SSO/IAM providers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T15:10:16Z","date_published":"2026-09-10T15:10:16Z","id":"https://feed.craftedsignal.io/briefs/2026-09-capgo-auth-bypass/","summary":"Capgo contains an authentication bypass vulnerability allowing attackers with a user password to ignore MFA requirements and mint persistent administrative API keys by exploiting improper session assurance level validation.","title":"Authentication Bypass in Capgo via MFA Assurance Level Validation Failure","url":"https://feed.craftedsignal.io/briefs/2026-09-capgo-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Capgo (All Versions)","version":"https://jsonfeed.org/version/1.1"}