CVE-2026-56073
Last modified
CVE-2026-56073 is a critical-severity vulnerability rated 9.4/10 on the CVSS scale. Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-56073?
How severe is CVE-2026-56073?
How do I fix CVE-2026-56073?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56068Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versi…9.3
- CVE-2026-56069Unauthenticated Insecure Direct Object References (IDOR) in …7.5
- CVE-2026-5607A security vulnerability has been detected in imprvhub mcp-b…6.3
- CVE-2026-56070Unauthenticated SQL Injection in Advance Product Search <= 1…9.3
- CVE-2026-56071Unauthenticated Cross Site Scripting (XSS) in Forminator <= …7.1
- CVE-2026-56072Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.…7.1
- CVE-2026-56074PraisonAI before 1.5.128 caches tool approval decisions by t…6.8
- CVE-2026-56075PraisonAI before 4.5.128 contains an arbitrary shell command…8.8
- CVE-2026-56076PraisonAI before 1.5.128 contains a cross-origin agent execu…8.6
- CVE-2026-56077PraisonAI before 1.5.115 contains an information disclosure …7.1
- CVE-2026-56078PraisonAI before 1.5.115 contains a path traversal vulnerabi…8.8
- CVE-2026-56079Capgo before 12.128.2 contains a cross-tenant authorization …7.1
Are you affected by CVE-2026-56073?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST