TI-2026-40659 Aliases CVE-2026-56294 GHSA-58pv-hg46-37r9

capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded

MEDIUM 53CWE-287Published 2026-06-20 · Updated 2026-11-08

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00235 14th percentileScored 2026-11-07

Fix Fixed capacitor-native-biometric (capacitor-native-biometric): 12.128.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
capacitor-native-biometric	capacitor-native-biometric	before 12.128.2	12.128.2	Patch available	CNA

capacitor-native-biometric Vendorcapacitor-native-biometric Affected before 12.128.2 Fixed in 12.128.2 Patch available CNA

Remediation

Fix · CNA capacitor-native-biometric (capacitor-native-biometric) Fixed in 12.128.2

Timeline

2026-10-02 Threatist record created from CVE-2026-56294
2026-10-03 Alias added: GHSA-58pv-hg46-37r9

References

Advisory 1

GitHub Security Advisory (GHSA-vx5f-vmr6-32wf)

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences