CVE-2026-53981: Cap-Go

High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days.

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

Affected products

• Cap-Go Cap-Go: before 12.128.2 (fixed in 12.128.2)

Published 2026-06-12. Last modified 2026-06-17.