{"id":"CVE-2026-56254","revision":"c074bb498ccc49099d86a885e27415f5","records":[{"revision":"c074bb498ccc49099d86a885e27415f5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-56254","aliases":[],"title":"capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution","description":"In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by the original app maker.","state":0,"publishedAt":"2026-07-10T13:57:52.184+00:00","modifiedAt":"2026-10-08T15:23:22.601+00:00","affected":[{"ecosystem":"Vendor product","name":"capacitor-updater","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"capacitor-updater\",\n                    \"product\": \"capacitor-updater\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/%40capgo/capacitor-updater\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"12.128.2\"\n                        },\n                        {\n                            \"version\": \"12.128.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.3,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","score":7,"severity":"HIGH"}],"references":["https://github.com/Cap-go/capgo/security/advisories/GHSA-j2f4-4pfc-p8rx","https://www.vulncheck.com/advisories/capacitor-updater-end-to-end-encryption-bypass-via-private-key-distribution"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56254","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-56254","identifiers":["CVE-2026-56254"]},"retained":false,"historicalAffected":[]}],"coverage":[]}