CVE-2026-56224 — Capgo - Login CSRF and Session Fixation via URL Query Parameters
Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers …
Published: 2026-06-30 · CVSS: 5.1 · CVSS 4.0
Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7