THREAT OPS › Threat News › [NVD] CVE-2026-56223 (HIGH 8.7) — Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admi
[NVD] CVE-2026-56223 (HIGH 8.7) — Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admi
CVE-2026-56223 CVSS: 8.7 HIGH Published: 2026-06-24T13:16:33.067
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions
MITRE ATT&CK techniques
- Email AddressesT1589.002
Indicators of compromise
- CVE-2026-56223cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-56223