Capgo applications prior to version 12.128.2 contain a CWE-601 open redirect flaw in the stripe_portal and stripe_checkout endpoints. The endpoints accept callbackUrl, successUrl, and cancelUrl parameters without validating them, allowing an attacker to craft billing URLs that redirect users to malicious domains. This vulnerability enables phishing attacks and credential harvesting by luring users to attacker‑controlled sites.

The affected product is Capgo. Any installation running a version earlier than 12.128.2 is vulnerable.

The CVSS score of 4.8 indicates moderate severity, but the exploitability is limited to authenticated users who have permission to generate billing URLs. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not been reported as a known exploited vulnerability. Nevertheless, the potential for phishing and credential theft warrants proactive mitigation.