CVE-2026-56224

Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.

Scoring

Severity
MEDIUM
CVSS base score
5.4
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS probability
0.27%
CWE
CWE-384
Published
2026-06-30
Last modified
2026-07-01

Affected products

Weakness type

Related vulnerabilities

Markdown version · Browse all CVEs