Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email
Description
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-level policies, while the legitimate user is denied access to the account tied to their own email.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Missing email verification before account activation allows an attacker to register and configure 2FA on an account bound to a victim's email address."
Attack vector
An attacker registers an account using the victim's email address without needing to verify ownership of that email [ref_id=1]. Because the signup flow does not require email verification before granting dashboard access, the attacker can log in, enable two-factor authentication (2FA), and enforce organization-level 2FA policies on the unverified account [ref_id=1]. The legitimate email owner is then permanently locked out: they cannot register (account already exists), and even after a password reset they cannot log in because 2FA is required and controlled by the attacker [ref_id=1]. This is a pre-account takeover that also constitutes a denial-of-service against the victim.
Affected code
The advisory does not specify exact file paths or functions; the flaw resides in the signup and authentication flow where email verification is not enforced before dashboard access and 2FA configuration.
What the fix does
The advisory recommends enforcing mandatory email verification before dashboard access, blocking 2FA setup until the email is verified, and preventing policy enforcement from unverified accounts [ref_id=1]. No patch diff is provided in the bundle, so the exact code changes are not visible; however, the remediation guidance makes clear that the root cause is the lack of email ownership validation before granting account access and security feature configuration.
Preconditions
- inputThe attacker must know the victim's email address to register an account with it.
- configThe application must allow dashboard access and 2FA configuration without requiring email verification.
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-j4cx-5pw6-5v5jmitrevendor-advisory
- www.vulncheck.com/advisories/cap-go-account-lockout-via-2fa-misconfiguration-on-unverified-emailmitrethird-party-advisory
News mentions
0No linked articles in our index yet.