CVE-2026-56073

Executive Summary

CVE-2026-56073 is a critical authentication bypass vulnerability in Cap-go, a Go-based application framework, affecting versions prior to 12.128.2. The flaw resides in the OTP (One-Time Password) verification mechanism, where an attacker can intercept and manipulate HTTP responses to falsely mark email verification as successful. This allows unauthorized enablement of two-factor authentication (2FA) and full account takeover without requiring valid credentials. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and potential for complete compromise of user accounts. No public proof-of-concept (PoC) or exploit code is currently available, but the attack vector is straightforward: man-in-the-middle (MITM) or proxy-based interception of OTP verification requests.

Supply Chain & Package Security

Cap-go is a Go-based package used for building web applications. The vulnerability is introduced in the OTP verification logic within the package itself. Organizations using Cap-go as a dependency in their Go projects are at risk. The supply chain impact is significant because any application that integrates Cap-go for email/OTP-based authentication inherits this vulnerability. The patch (version 12.128.2) must be applied to the dependency in the project's go.mod file. There is no evidence of malicious package versions or typosquatting, but the risk of dependency confusion exists if internal registries are not properly configured.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – Requires only network access to intercept/modify HTTP responses.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required beyond the OTP flow.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full account data exposure.
• Integrity (I): High (H) – Attacker can modify account settings (e.g., enable 2FA).
• Availability (A): High (H) – Account lockout or denial of service possible.

Threat Level: Critical. The vulnerability allows complete account takeover with minimal effort. The lack of authentication requirements and the ability to bypass OTP verification makes it highly attractive for attackers.

Deep Dive & Mechanics

The vulnerability exists in the OTP verification endpoint of Cap-go. The application sends an OTP to the user's email and expects a verification request containing the OTP code. The server then validates the code and returns a JSON response indicating success or failure. The flaw is that the server trusts the client's HTTP response to determine if verification was successful, rather than performing server-side validation of the OTP.

Attack Flow:

1. Attacker initiates a password reset or account registration flow that requires email verification.
2. The application sends an OTP to the victim's email.
3. Attacker intercepts the OTP verification request (e.g., via a proxy like Burp Suite or mitmproxy).
4. Attacker modifies the HTTP response from the server (or the client-side response) to indicate success, e.g., changing {"verified": false} to {"verified": true}.
5. The application accepts the manipulated response and marks the email as verified.
6. Attacker can then enable 2FA on the victim's account or change credentials, leading to account takeover.

The root cause is improper server-side validation of the OTP verification result. The application should not rely on client-side responses for security-critical operations.

Vulnerable vs. Patched Code

Vulnerable Code (Cap-go < 12.128.2):

// OTP verification handler
func verifyOTP(w http.ResponseWriter, r *http.Request) {
    // ... parse OTP from request ...
    if otp == expectedOTP {
        w.Write([]byte(`{"verified": true}`))
    } else {
        w.Write([]byte(`{"verified": false}`))
    }
}

The client-side code then checks this response and proceeds with the flow. An attacker can intercept and modify the response to {"verified": true} regardless of the actual OTP.

Patched Code (Cap-go >= 12.128.2):

// OTP verification handler
func verifyOTP(w http.ResponseWriter, r *http.Request) {
    // ... parse OTP from request ...
    if otp == expectedOTP {
        // Server-side session marking
        session.MarkEmailVerified(userID)
        w.Write([]byte(`{"verified": true}`))
    } else {
        w.Write([]byte(`{"verified": false}`))
    }
}

The patched version performs server-side state changes (e.g., marking the email as verified in the session or database) before sending the response. This ensures that even if the response is manipulated, the server-side state remains unchanged.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: A web application using Cap-go < 12.128.2.
• Tools: Burp Suite, mitmproxy, or any HTTP intercepting proxy.
• Steps:
  1. Navigate to the registration or password reset page.
  2. Enter the victim's email address and trigger OTP sending.
  3. Intercept the OTP verification request (e.g., POST to /verify-otp).
  4. Forward the request to the server (or modify the OTP code if needed).
  5. Intercept the server's response.
  6. Modify the response body from {"verified": false} to {"verified": true}.
  7. Forward the modified response to the client.
  8. The application will now treat the email as verified.
  9. Proceed to enable 2FA or change the password.

Example Burp Suite Repeater Modification:

POST /verify-otp HTTP/1.1
Host: target.com
Content-Type: application/json

{"otp": "123456"}

Response before modification:

{"verified": false}

Response after modification:

{"verified": true}

Blue Team (Detection & Prevention)

Detection:

• Monitor for multiple OTP verification attempts from the same IP in a short time.
• Alert on responses where verified is true but the OTP was incorrect (server-side logging).
• Use Web Application Firewall (WAF) rules to block response manipulation (e.g., inspect response bodies for unexpected changes).

Prevention:

• Apply the patch to Cap-go version 12.128.2 or later.
• Implement server-side validation of OTP verification results.
• Use signed or encrypted tokens for verification responses.
• Enable logging of all OTP verification attempts and outcomes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP responses with {"verified": true} where the OTP was invalid.
  • Repeated OTP verification requests from the same IP address.
  • Unusual patterns in the Referer or User-Agent headers during OTP flows.
• Host IOCs:
  • Log entries showing verified: true for failed OTP attempts.
  • Sudden enablement of 2FA on accounts without prior user action.
  • Password change requests originating from unusual locations.
• File IOCs:
  • Modified go.mod or go.sum files indicating a rollback to a vulnerable version.
  • Presence of proxy tools (e.g., Burp Suite, mitmproxy) on the server (unlikely but possible).

Detection Engineering

YARA Rule

rule CVE_2026_56073_OTP_Bypass {
    meta:
        description = "Detects Cap-go OTP verification bypass attempts"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56073"
    strings:
        $response_true = "{\"verified\": true}"
        $response_false = "{\"verified\": false}"
        $otp_endpoint = "/verify-otp"
    condition:
        $otp_endpoint and $response_true and not $response_false
}

Sigma Rule

title: Cap-go OTP Verification Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP responses indicating OTP verification success without proper validation
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/verify-otp'
        sc-status: 200
        cs-content-type: 'application/json'
        response_body: '{"verified": true}'
    condition: selection
falsepositives:
    - Legitimate OTP verification
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56073 Cap-go OTP Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/verify-otp"; http_uri; content:"{\"verified\": true}"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Cap-go to version 12.128.2 or later. Update the dependency in go.mod:

   require cap-go v12.128.2
   

2. Workaround: If patching is not immediately possible, implement a reverse proxy that validates OTP verification responses server-side. For example, use a middleware that checks the OTP against a server-side store before allowing the response to be sent.
3. Monitoring: Enable detailed logging of OTP verification attempts and set up alerts for anomalies.
4. User Education: Inform users to be cautious of unexpected 2FA enablement or password reset emails.
5. Network Segmentation: Restrict access to the OTP verification endpoint to trusted networks if possible.

Valters IT