Unrated severityNVD Advisory· Published Jun 20, 2026
Capgo - Open Redirect via confirmation_url Parameter
CVE-2026-56332
Description
Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-24q8-ghqq-m8cjmitrevendor-advisory
- www.vulncheck.com/advisories/capgo-open-redirect-via-confirmation-url-parametermitrethird-party-advisory
News mentions
1- Capgo: 21 CVEs Disclosed Together — Unauthenticated Cross-Tenant Bugs and Scope Escalation Lead the BatchVypr Intelligence · Jun 20, 2026