Medium severity6.4NVD Advisory· Published Jun 22, 2026· Updated Jun 23, 2026
CVE-2026-56306
CVE-2026-56306
Description
Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Capgo: 25 CVEs Disclosed in Single Batch — Auth Bypasses, SQLi, and Missing RLSVypr Intelligence · Jun 24, 2026