The vulnerability is an authentication bypass that occurs in Cap-go when an attacker intercepts OTP verification requests and manipulates the HTTP response. By altering the server’s response to indicate a successful verification, an attacker can enable two‑factor authentication (2FA) on an account without proper authorization and then take full control of that account. The weakness is classified as CWE‑345, an insecure handling of authentication data.

Cap‑go web application versions prior to 12.128.2 are affected. This includes all deployments of the Cap‑go product before the 12.128.2 release, regardless of host or deployment environment. No further product or vendor detail is supplied beyond the Cap‑go identifier.

The CVSS score of 9.3 reflects a high‑impact authentication bypass. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker with network access can listen in on OTP verification traffic, modify the server response, and falsely mark an account as verified. Once 2FA is enabled by the attacker, the account can be accessed and fully controlled.