Capgo versions prior to 12.128.2 contain a broken authentication flaw in the API key creation path. The backend exposes the key in the frontend request and does not verify that the supplied key belongs to the authenticated user. An attacker can modify the key field in this request, inject an arbitrary value, and cause the server to store a custom key for the victim’s account, granting access to all protected endpoints that require that key.

The vulnerability affects Capgo installations using any version before 12.128.2. The product is identified as Capgo from the vendor Capgo, and no further specific version details are provided beyond the release threshold mentioned in the advisory.

The CVSS score of 9.3 indicates critical severity. Because the exploit does not rely on authentication, it can be carried out remotely via crafted requests. EPSS data is unavailable, and the issue is not yet listed in CISA’s KEV catalog. The absence of server‑side key validation allows an attacker to repeatedly generate unauthorized keys without detection, keeping the risk high until a patch is applied.