CVE-2026-56294
Last modified
CVE-2026-56294 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.
Metrics
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-56294?
How severe is CVE-2026-56294?
How do I fix CVE-2026-56294?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56289GNU patch is vulnerable to a denial of service (DoS) due to …5.5
- CVE-2026-5629A vulnerability was detected in Belkin F9K1015 1.00.10. The …8.8
- CVE-2026-56290Joomla Extension - joomlack.fr - Unauthenticated file upload…9.8
- CVE-2026-56291Joomla Extension - balbooa.com - Unauthenticated file upload…9.8
- CVE-2026-56292Joomla Extension - acymailing.com - SQL Injection in AcyMail…7.5
- CVE-2026-56293Capgo before 12.128.2 contains an authorization flaw in tran…5.4
- CVE-2026-56295Capgo before 12.128.2 contains an authorization bypass vulne…6.3
- CVE-2026-56296Cap-go before 12.128.2 contains an information disclosure vu…6.9
- CVE-2026-56297FreeRDP before 3.22.0 contains a use-after-free vulnerabilit…8.1
- CVE-2026-56298Capgo before 12.128.2 fails to strip EXIF metadata from imag…5.3
- CVE-2026-56299Capgo before 12.128.2 contains an authentication bypass vuln…6.9
- CVE-2026-5630A flaw has been found in assafelovic gpt-researcher up to 3.…4.3
Are you affected by CVE-2026-56294?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST