CVE-2026-56224
Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.4
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.27%
- CWE
- CWE-384
- Published
- 2026-06-30
- Last modified
- 2026-07-01
Affected products
- Capgo Capgo
- Capgo Capgo
Weakness type
Related vulnerabilities
- CVE-2026-64857 — tirreno has Session Fixation in Login Authentication
- CVE-2026-86674 — ningzichun Student Management System login.php session_start session fixiation
- CVE-2026-76196 — Photoshop Mobile | Session Fixation (CWE-384)
- CVE-2026-86279 — SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation
- CVE-2026-85238 — Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
- CVE-2026-18527 — IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].
- CVE-2026-81826 — Flowintel Fails to Invalidate Active Sessions After Password Change
- CVE-2026-70594 — Ghost: Session Fixation in Ghost Admin