Capgo versions prior to 12.128.2 contain a denial‑of‑service flaw in the /auth/v1/otp endpoint that causes captcha verification to fail repeatedly. The backend then returns HTTP 500 errors with a captcha verification failed message, preventing authenticated users from completing two‑factor authentication enrollment. The vulnerability is a functional failure classified as CWE‑703 and blocks a critical security control.

The vulnerable product is Capgo. Versions before 12.128.2 (i.e., 12.128.1 or earlier) are impacted. Any installation running those earlier releases is at risk.

The CVSS score of 6.9 denotes moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is repeated requests to the /auth/v1/otp endpoint that trigger captcha failures. An attacker with valid credentials could repeatedly request OTPs to disable 2FA enrollment for victim accounts, or an automated script could abuse the endpoint to cause widespread denial of service for users attempting to activate two‑factor authentication. While exploitation does not grant direct access to encrypted data, it undermines account security by blocking an essential defense mechanism.