HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-56223 — Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability...

·Source: NIST NVD

Updated:

Executive Summary

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and ga

Analysis

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data. CVSS Score: 8.7. Published: 2026-06-24T13:16:33.067.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56223
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Digital Prime Technologies expands Tokenet to BitGo Bank & Trust

Digital Prime Technologies, a provider of digital asset technology solutions and developer of Tokenet, today announced the completion of Tokenet's integration with BitGo Bank & Trust, National Association ("BitGo Bank & Trust"), an OCC-regulated digital asset trust bank and subsidiary of BitGo Holdings, Inc. (NYSE: BTGO) ("BitGo"), the digital asset infrastructure company.

Finextra
MEDIUMVulnerabilityNEW

Big payment names back new stablecoin

Visa, Mastercard, US Bank, Google and Coinbase are among dozens of firms backing Open USD, a new stablecoin slated to launch later this year.

Finextra
MEDIUMVulnerability

House passes kids’ online safety bill, but Senate approval unlikely

The Kids Internet and Digital Safety (KIDS) Act passed with bipartisan support by a 267-117 margin, winning the two-thirds majority needed to greenlight the legislation under a process that speeds up a bill’s path to a vote but requires more than a simple majority.

The Record