CVE-2026-56330 — Capgo - Open Redirect via Unvalidated Stripe Billing URLs
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl param…
Published: 2026-06-20 · CVSS: 4.8 · CVSS 4.0
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft malicious billing URLs to redirect users to attacker-controlled domains for phishing and credential harvesting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7