CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-56237 — Capgo before 12.128.2 contains a broken authentication vulnerability in its API ...

·Source: NIST NVD

Updated:

Executive Summary

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper

Analysis

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper authorization, which can lead to unauthorized access to protected endpoints. CVSS Score: 9.1. Published: 2026-06-24T13:16:33.467.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56237
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Major UK banks adopt Swift consumer payments framework

Barclays, HSBC, Lloyds and NatWest will be among the first financial institutions in the world to go live with Swift's new framework for cross-border retail payments.

Finextra
MEDIUMVulnerabilityNEW

Payward completes Reap acquistion

Payward, a unified financial infrastructure platform advancing an open, global financial system, today announced the completion of its acquisition of Reap Technologies Holdings Limited (“Reap”), a leading stablecoin-native, card issuing and payments infrastructure company enabling global money movement.

Finextra
MEDIUMVulnerabilityNEW

Oman Arab Bank completes Visa tokenisation rollout

Oman Arab Bank (OAB) and BPC, a global leader in payment solutions, are marking 10 years of partnership, celebrating a decade of card and payments modernisation that has helped reshape the bank’s issuing and acquiring business in Oman.

Finextra