CVE-2026-53981
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
64/100
Published: 2026-06-12
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
High
VI:
Low
VA:
Low
Description
Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.
Weakness Classification (1)
References & Advisories (3)
vendor-advisory
third-party-advisory
patch