The vulnerability in Capgo involves failure to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. An attacker with a standard Capgo full API key can insert rows with status='active' and enforce_sso=true, bypassing backend SSO provisioning controls such as Enterprise plan requirements, domain ownership verification, and trusted provider ID issuance. The forged SSO provider entries are trusted by SSO discovery and enforcement logic, including unauthenticated login preflight endpoints, allowing attacker-controlled SSO enforcement for arbitrary domains. This disrupts normal login flows and undermines the integrity of SSO enforcement.

Attackers can bypass intended SSO provisioning controls and create forged active SSO providers for arbitrary domains without verification. This allows assertion of enforced SSO login for domains that have not been verified, disrupting normal login processes and potentially causing denial of service or unauthorized login behavior. The vulnerability has a critical severity with a CVSS 4.0 score of 9.3, indicating high impact on confidentiality, integrity, and availability.

At the time of the advisory, no patch or official fix was available. Users should monitor the vendor advisory for updates. Until a fix is released, restrict access to Capgo full API keys to trusted personnel only and consider limiting exposure of the public.sso_providers table through Supabase PostgREST. Review and tighten access controls to prevent unauthorized direct writes to sensitive tables.