CVE-2026-53982
HIGH EPSS 24.7%
Published Jun 12, 20263w ago · Modified Jun 17, 20262w ago
7.1 CVSS 4.0
Published Jun 12, 2026 3w ago
Last Modified Jun 17, 2026 2w ago
Description
Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform incorrectly associates the deletion state with the device identifier, causing the affected device or browser environment to be redirected to an account-disabled page for approximately 30 days, preventing any account login or registration from that device.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
24.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-645
References 3
- github.com https://github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e
- github.com https://github.com/Cap-go/capgo/security/advisories/GHSA-qmrm-qgwr-55jf
- vulncheck.com https://www.vulncheck.com/advisories/capgo-console-account-deletion-dos-via-device-identifier-association
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.