Medium severity4.8NVD Advisory· Published Jun 20, 2026· Updated Jun 22, 2026

CVE-2026-56294

Description

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Npm/Capacitor Native Biometricinferred
Range: <12.128.2
Package: https://npmjs.com/package/capacitor-native-biometric
Cap Go/Capgo.appllm-fuzzy
Range: <12.128.2

Patches

Vulnerability mechanics

References

github.com/Cap-go/capgo/security/advisories/GHSA-vx5f-vmr6-32wfnvd
www.vulncheck.com/advisories/capacitor-native-biometric-authentication-bypass-via-unvalidated-cryptoobject-in-onauthenticationsucceedednvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000