CVE-2026-56228
Last modified
CVE-2026-56228 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimum password length, making compliance impossible for all organization members. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimum password length, making compliance impossible for all organization members. Once the policy is enabled, users (including administrators) are unable to change their passwords or access the organization, resulting in an organization-wide account lockout and application-level denial of service.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-56228?
How severe is CVE-2026-56228?
How do I fix CVE-2026-56228?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56222Capgo before 12.128.2 contains an authorization bypass vulne…8.6
- CVE-2026-56223Capgo before 12.128.2 contains a cross-domain SSO account ta…9.3
- CVE-2026-56224Capgo console.capgo.app/login before 12.128.2 accepts access…5.4
- CVE-2026-56225Capgo before 12.128.2 contains an authorization bypass vulne…8.7
- CVE-2026-56226Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase Po…8.7
- CVE-2026-56227Capgo before 12.128.2 contains a server-side request forgery…5.4
- CVE-2026-56229Capgo before 12.128.2 contains an authorization bypass vulne…7.1
- CVE-2026-5623A vulnerability was identified in hcengineering Huly Platfor…6.3
- CVE-2026-56230Capgo before 12.128.2 contains a broken object level authori…8.8
- CVE-2026-56231Capgo before 12.128.2 contains a broken object level authori…7.6
- CVE-2026-56232Capgo before 12.128.2 fails to enforce limited_to_orgs and l…8.8
- CVE-2026-56233Capgo before 12.128.2 contains a path traversal vulnerabilit…8.7
Are you affected by CVE-2026-56228?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST