The vulnerability in Capgo prior to version 12.128.2 involves an authentication bypass in the password change functionality. Attackers who have temporary access to a user session can exploit this to change the user's password without needing to confirm the existing password. This enables attackers to lock out legitimate users and gain full control over their accounts. The vulnerability is categorized under CWE-620 (Authentication Bypass by Assumed-Immutable Data). There is no explicit patch or remediation information available at this time.

Attackers with temporary session access can exploit this vulnerability to change user passwords without authentication, resulting in permanent lockout of legitimate users and full account takeover. This compromises user account integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict session access and monitor for suspicious activity related to password changes.