CVE-2026-53981

Name of the Vulnerable Software and Affected Versions Cap-go versions prior to 12.128.2

Description An account takeover issue exists in the email change mechanism. An attacker with temporary authenticated session access can change the registered email address without requiring re-authentication, such as a password or Multi-Factor Authentication (MFA) verification. This allows the attacker to redirect verification to an email address under their control and subsequently perform a password reset to gain permanent control of the victim's account.

Recommendations Update to version 12.128.2 or later.