Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@capgo/capacitor-native-biometric

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.2npmAmendedPublished

    cap-go/capacitor-native-biometric Authentication Bypass

    CVE-2026-56294 · GHSA-vx5f-vmr6-32wf

    Affected
    • npm @capgo/capacitor-native-biometric < 8.3.6
    Fixed in
    8.3.6· Vendor fix available
    Issue
    There is a potential issue with the cap-go/capacitor-native-biometric library. --- Summary The cap-go/capacitor-native-biometric library was found to be subject to an authentication bypass as the current implementation of the onAuthenticationSucceeded() does not appear to handle a CryptoObject[^HackTricks1] [^SecuringBiometricAuthentication] as seen in the following code block starting from line 88 in AuthActivity.java: As the current implementation only checks whether onAuthenticationSucceeded() was called and does not handle a CryptoObject the biometric authentication can be bypassed by hooking the onAuthenticationSucceeded() function. PoC Video: https://github.com/user-attachments/assets/b7b5a2bc-21dc-4373-b371-84b002dae7a7 Environment: The following steps were taken to create and deploy a Capacitor application using the cap-go/capacitor-native-biometric library for the purpose of verifying this finding. Note at the time of writing the npx create-react-app command broke, so I have…

    Recommended action: Upgrade to 8.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →