---
id: CVE-2026-56073
title: Cap-go - OTP Bypass via Response Manipulation in Email Verification
summary: >-
  Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP
  verification that allows attackers to bypass email verification by modifying
  server responses. Attackers can intercept OTP verification requests and
  manipulate…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-345
vendor: Cap-go
product: capgo
affected:
  - capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-22T15:27:50.367413Z'
exploitAvailable: true
published: '2026-06-19'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:23.826Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56073'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-x2gq-85v8-j9v4'
    label: GitHub Security Advisory (GHSA-x2gq-85v8-j9v4)
  - url: >-
      https://www.vulncheck.com/advisories/cap-go-otp-bypass-via-response-manipulation-in-email-verification
    label: >-
      VulnCheck Advisory: Cap-go - OTP Bypass via Response Manipulation in Email
      Verification
tags:
  - cve.org
  - exploit-available
epss: 0.00229
epssPercentile: 0.13795
ingestedAt: '2026-11-08T14:51:22.373Z'
---

## Overview

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

## Affected

- `capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.