CVE-2026-56254High· 7.0▾ TwilightIn @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker perfo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by the original app maker.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2014-125135High· 7.3OctoPrint Flask Secret Key hard-coded key
CVE-2026-113466Medium· 5.3MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
CVE-2026-108798High· 7.3A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206
CVE-2018-0732High· 7.5During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client
CVE-2026-105392High· 7.3A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12
CVE-2026-102241Low· 2.7A vulnerability was determined in Netcore NAP930 0.1.241010.141410