Capgo prior to 12.128.2 implements a confirm‑signup endpoint that accepts a confirmation_url parameter without validation, allowing the application to redirect users to any external website. This flaw enables attackers to construct malicious links, facilitating phishing or credential‑harvesting campaigns. The vulnerability represents a CWE‑601 open redirect weakness, which can compromise user trust and potentially lead to credential theft.

The flaw affects Capgo by Capgo, specifically all releases before version 12.128.2. Users running older Capgo deployments are vulnerable and should verify their installed version.

The CVSS score of 5.1 indicates moderate severity. Because no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, the exploitation likelihood is uncertain but could be exploitable through crafted URLs. Attackers can trigger the redirect simply by luring a user to a link containing a malicious confirmation_url, making the attack path straightforward from a network perspective.