Capgo prior to version 12.128.2 contains a cross‑domain single sign‑on flaw in the provision‑user endpoint that allows an attacker to merge arbitrary victim accounts based solely on email match, without validating that the SSO provider domain is authorized. An attacker who gains enterprise organization administrator rights and controls a malicious identity provider can forge SAML assertions that include victim email addresses, trigger the vulnerable merge operation, and thereby obtain full access to the victim’s account, organization, and data.

Capgo, product Capgo, vulnerable for all releases prior to 12.128.2. Versions 12.128.2 and later are not affected.

The vulnerability carries a CVSS score of 9.3, indicating critical severity, and it is not currently listed in the CISA KEV catalog. The EPSS score is not available, implying that the exploitation probability is unknown but potentially high given the critical nature of account takeover. The likely attack vector involves an attacker with enterprise organization admin privileges who can issue forged SAML assertions from a malicious identity provider; this enables account merge and takeover without any additional user interaction.