A critical authentication bypass vulnerability in Capgo allows attackers to perform privileged administrative operations without satisfying MFA requirements.

The application fails to validate the Authentication Assurance Level (AAL) during JWT processing and RBAC checks, allowing a password-only (AAL1) session to bypass MFA requirements. This flaw resides in the Edge JWT middleware and the direct RBAC authorization path, enabling unauthorized users to mint persistent administrative API keys.

This vulnerability poses a severe risk to the integrity of the application's production environment. By bypassing MFA, an attacker can gain unauthorized administrative access, allowing them to modify OTA channel configurations and deploy malicious updates to end-user devices. Given the CVSS score of 8.3, this flaw represents a high risk for supply chain compromise and significant reputational damage.

Immediate Action: As no patch is currently available, administrators should restrict access to the affected management interfaces and closely monitor for any unauthorized API key generation or unexpected changes to production OTA configurations.

Proactive Monitoring: Review all system logs for suspicious authentication patterns, particularly sessions originating from unknown IP addresses, and audit all existing app-scoped API keys for signs of unauthorized creation.

Compensating Controls: Implement network-level access controls or VPN requirements for accessing the management dashboard to limit the exposure of the vulnerable administrative endpoints to untrusted networks.

Public Exploit Available: Unknown.

The absence of a patch necessitates immediate defensive action to minimize the attack surface. Organizations utilizing Capgo should prioritize the implementation of restrictive network controls and maintain a heightened state of monitoring for administrative account activity until the vendor provides a remediation update.