A credential validation endpoint in Capgo can be invoked by using only the public Supabase key, with no authentication required. The endpoint is CORS‑permissive, allowing any origin to call it, and it lacks rate limiting. An attacker can repeatedly submit guessed passwords for known usernames, effectively performing password spraying or credential stuffing to compromise user accounts. The weakness belongs to CWE‑307, describing insecure authentication due to improper safeguards against credential enumeration.

Capgo software, versions earlier than 12.128.2, is affected. Administrators using these releases should verify the firmware or application version and plan an upgrade.

The CVSS score of 6.9 indicates a moderate severity. Because the public key is normally publicly accessible and the endpoint is reachable from any origin, the likelihood of exploitation is high. No rate limiting means an attacker can submit thousands of credential attempts in a short period, increasing the probability of successful account takeover. The vulnerability is not listed in the CISA KEV catalog and no EPSS data is available, but the described attack vector strongly suggests that this flaw can be abused in the wild.