Capgo - Open Redirect via confirmation_url Parameter | Advisories

Advisories

Capgo - Open Redirect via confirmation_url Parameter

severity: medium
date: 6/20/2026
Affecting: Capgo >= 0, < 12.128.2
CVE: CVE-2026-56332
CWE: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
References: GHSA Advisory GHSA-24q8-ghqq-m8cj
Credit: muhnabil04
Description: Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo