CVE-2026-88861 is an authentication bypass vulnerability in Capgo (capgo.app) affecting all versions. The issue arises because the Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions without validating the MFA assurance level. Specifically, the Edge JWT middleware (foundJWT() in supabase/functions/_backend/utils/hono_middleware.ts) accepts JWT tokens without checking their assurance level, and the RBAC authorization functions (checkPermission()/checkPermissionPg()) authorize by user ID without verifying the session's assurance level, unlike the public.verify_mfa() control which requires aal2. This enables an attacker with only the victim's password to authenticate, mint a persistent app-scoped app_admin API key that remains valid after logout, and perform privileged actions such as modifying production OTA channel configurations, effectively bypassing MFA protections.

An attacker who knows only the victim's password can bypass MFA protections and gain privileged RBAC permissions. They can mint persistent admin API keys that remain valid beyond the session and perform sensitive operations, including modifying production OTA channel configurations. This compromises the security model that relies on MFA and role-based access control, potentially leading to unauthorized administrative actions and system compromise.

No official fix or patch is available at the time of publication. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider additional compensating controls such as monitoring for unusual API key creation or privileged actions, and restricting access where possible. Avoid relying solely on password authentication and MFA enforcement until the vulnerability is addressed.