CVE-2026-42560 Details
Description
auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. In practice, this means all Patreon-authenticated users of an application using this library are collapsed into a single local identity. Any application that trusts token.User.ID as the stable account key can end up mixing or fully merging unrelated Patreon users, which can lead to cross-account access, privilege confusion, and subscription-state leakage. This issue has been patched in versions 1.25.2 and 2.1.2.
A vulnerability exists in the Patreon OAuth provider of the Go-PKGZ Auth library, affecting versions 1.18.0 prior to 1.25.2 and 2.0.0 prior to 2.1.2. The issue arises because the provider maps all authenticated Patreon accounts to the same local user ID, instead of creating a unique ID based on the individual Patreon account. This flaw causes all Patreon-authenticated users within an application to be treated as a single identity. As a result, applications that rely on the token.User.ID as a stable account identifier may inadvertently merge or mix unrelated Patreon users, leading to cross-account access, confusion over privileges, and unauthorized sharing of subscription information.
Users can update to Go-PKGZ Auth versions 1.25.2 or 2.1.2, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 9, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-pkgz/auth/security/advisories/GHSA-f6qq-3m3h-4g42 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/go-pkgz/auth/commit/c0b15ee72a8401da83c01781c16636c521f42698 | [email protected] | Source CodeVendor |
| https://github.com/go-pkgz/auth/releases/tag/v1.25.2 | [email protected] | Release NotesVendor |
| https://github.com/go-pkgz/auth/releases/tag/v2.1.2 | [email protected] | Release NotesVendor |
| https://github.com/go-pkgz/auth/security/advisories/GHSA-f6qq-3m3h-4g42 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github.com/go-pkgz/auth | All versions |
CPE
Remediation
| |
| github.com/go-pkgz/auth/v2 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |