Dashboard / CVE-2026-56332

CVE-2026-56332

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 60/100
Published: 2026-06-20 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
AT: None
VC: None
VI: Low
VA: None

Description

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Capgo Capgo 0 < 12.128.2

References & Advisories (2)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

EPSS — Exploitation Probability

0.22%
Raw Score 0.002170
Percentile 12.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00217
2026-11-12
0.00217
2026-11-10
0.00217
2026-11-09
0.00217
2026-11-08
0.00217

Intelligence Sources

mitre ref →

External Links