CVE-2026-56081
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedCap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-level policies, while the legitimate user is denied access to the account tied to their own email.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceCap-go before 12.128.2 has an authentication logic flaw where an attacker can register an account using a victim's email address before email verification completes. The attacker then enables 2FA on this pre-registered account, achieving account takeover under the victim's identity and gaining ability to read/modify account state and enforce organization policies.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Cap-go versionCheck the installed Cap-go package version using your package manager (npm, yarn, or your deployment manifest) or query the application's /version endpoint if availableAffected if The installed version is lower than 12.128.2
-
Inspect pending registrations databaseQuery your user/registration database table for accounts where email_verified is false or where a verification token is still pending. Look for duplicate email entries with different account identifiersAffected if Multiple unverified registration records exist for the same email address
-
Test registration endpoint for duplicate emailsSubmit a registration request using an email that already has a pending verification. Check if a second account record is created before the original verification completesAffected if The system allows creating a new account registration for an email that already has a pending verification
-
Verify 2FA enablement on unverified accountsAttempt to enable two-factor authentication on an account that has not yet completed email verification. Check the 2FA enrollment flow and any associated database flagsAffected if 2FA can be enabled on accounts where email_verified equals false or where verification is still pending
-
Check for hijacked identity scenariosSearch user account records for cases where email_verified is true but the account was created via a duplicate registration flow, and review 2FA enrollment metadata timestamps relative to verification timestampsAffected if There exist accounts where 2FA was enrolled before email verification completed, or where the legitimate user's verification now fails due to an existing 2FA-bound account
You are affected if running Cap-go version below 12.128.2 and your system permits duplicate email registrations or allows 2FA enrollment on unverified accounts.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpdate to Cap-go version 12.128.2 or later. Additionally, audit existing accounts for any pre-registered accounts without verified emails and implement proper validation to ensure email verification must complete before account becomes active.
Cap-go version 12.128.2 or later
- 1. Identify the current installed version of Cap-go in your environment
- 2. If running a version before 12.128.2, plan for an upgrade to version 12.128.2 or later
- 3. Before upgrading, ensure you have a complete backup of your current configuration and data
- 4. Upgrade Cap-go to version 12.128.2 or the latest stable release available
- 5. After upgrade, verify that the email verification flow properly rejects duplicate registrations for unverified emails
- 6. Audit existing user accounts for any unauthorized pre-registrations that may have been created
- 7. Notify legitimate users who may have been affected by this vulnerability to verify their account status
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-56081 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-56081 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data