CVE-2026-56338
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Jun 24, 2026
CISA due date
—
The record
Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-80135 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-703
- CVE-2026-57445 Gardens v2 is a modular governance framework that enables communities to create and… CWE-703
- CVE-2026-82417 ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own… CWE-703
- CVE-2026-26446 Stomper 5e2741e is vulnerable to Denial of Service. CWE-703
- CVE-2026-18638 Any authenticated Velociraptor user — including one holding only the readerrole — can… CWE-703
- CVE-2026-56818 Netty is an asynchronous, event-driven network application framework. CWE-703
- CVE-2026-20187 As part of Cisco's ongoing commitment to proactive security and product quality, the… CWE-703
- CVE-2026-51600 Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in… CWE-703