CVE-2026-56294 capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded
Attackers can bypass biometric authentication in Capacitor apps by hooking the success callback, allowing unauthorized access without valid credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56294?
CVE-2026-56294 is a medium-severity authentication bypass vulnerability in capacitor-native-biometric, published on 20 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.
Weakness: CWE-287
Which versions are affected by CVE-2026-56294?
2 open source packages ship an affected version, including @capgo/capacitor-native-biometric.
| Package | Affected | Fixed in |
|---|---|---|
@capgo/capacitor-native-biometric npm | All versions | 8.3.6 |
@capgo/capacitor-native-biometric npm | All versions | 8.3.6 |
How do I fix CVE-2026-56294?
Upgrade @capgo/capacitor-native-biometric to 8.3.6 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-56294 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56294 exists.
Sources
Also known as GHSA-58pv-hg46-37r9, GHSA-vx5f-vmr6-32wf.