CVE-2026-56254
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
77/100
Published: 2026-07-10
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
High
VA:
Low
Description
In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by the original app maker.