Dashboard / CVE-2026-56294

CVE-2026-56294

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 44/100
Published: 2026-06-20 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Physical
AC: High
PR: None
UI: None
AT: None
VC: High
VI: Low
VA: None

Description

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
capacitor-native-biometric capacitor-native-biometric 0 < 12.128.2

References & Advisories (2)

Bug Bounty Relevance

44 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v4.0
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002350
Percentile 14.6%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00235
2026-11-12
0.00235
2026-11-10
0.00235
2026-11-09
0.00235
2026-11-08
0.00235

Intelligence Sources

mitre ref →

External Links