CVE-2026-56254

Name of the Vulnerable Software and Affected Versions @capgo/capacitor-updater versions prior to 12.128.2

Description The end-to-end encryption scheme distributes the private key to every device that downloads the application. Since the public key can be derived from the private key, an attacker who compromises the Capgo server or performs a man-in-the-middle attack can create a validly signed update bundle, leading devices to install updates not created by the original app maker.

Recommendations Update to version 12.128.2 or later.