Capgo contains an authentication bypass that allows an attacker with only a victim’s password to authenticate with an aal1 session and then exercise privileged RBAC permissions, including minting a persistent admin API key. This bypass circumvents MFA protection and permits the attacker to modify production OTA channel configurations and other privileged operations. The weakness lies in the failure of the Edge JWT middleware to validate the session assurance level and the direct RBAC check that authorizes by user ID without inspecting the session aal, a typical example of authentication bypass (CWE‑288).

All Capgo / Cap-go:capgo.app versions are affected. The vendor released no patched version at the time of this advisory. The vulnerability impacts the Edge authorization path within the Supabase backend functions, specifically the JWT middleware (foundJWT) and the RBAC utilities (checkPermission / checkPermissionPg).

The CVSS score of 8.7 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. An attacker can exploit this flaw remotely by sending authenticated requests with an aal1 session under the victim’s password. Because the middleware does not verify the assurance level, the attacker can obtain privileged roles and create long‑lived API keys that survive session logout, enabling continued unauthorized access.