CVE-2026-56224

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description The application automatically authenticates users without confirmation when access token and refresh token are provided in the URL query parameters of the '/login' endpoint. This behavior allows attackers to create malicious links that force victims into sessions controlled by the attacker, which also results in the exposure of tokens within browser history and server logs.

Recommendations Update to version 12.128.2 or later. Avoid passing access token and refresh token via URL query parameters in the '/login' endpoint.