Skip to content

End-to-end encryption vulnerability

High
riderx published GHSA-j2f4-4pfc-p8rx Feb 10, 2026

Package

npm @capgo/capacitor-updater (npm)

Affected versions

3.0.0

Patched versions

None

Description

Impact

What kind of vulnerability is it? Who is impacted?

currently the way end to end encryption is made is vulnerable to attack.

because the private key is send into each devices who download the app.

from the private key you can derivate the public key.

and create a new bundle who will be valid to install.

so a MIM attack or hacking capgo could lead to install a update not made by the original app maker.

Patches

Has the problem been patched? What versions should users upgrade to?

Not for now

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Finding a pair key system where the public key cannot be derivated would fix it

References

Are there any links users can visit to find out more?

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs