CVE-2026-42560 - Vulnerability Analysis

Overview

Auth versions 1.18.0 to <1.25.2 and 2.0.0 to <2.1.2 contain a broken authentication caused by Patreon OAuth provider mapping all authenticated accounts to the same local user ID, letting attackers cause cross-account access and privilege confusion, exploit requires use of affected versions.

Severity & Score

Impact

Attackers can cause cross-account access, privilege confusion, and subscription-state leakage by merging unrelated Patreon users.

Mitigation

Update to versions 1.25.2 or 2.1.2 or later.

References

• https://github.com/go-pkgz/auth/security/advisories/GHSA-f6qq-3m3h-4g42
• https://github.com/go-pkgz/auth/commit/c0b15ee72a8401da83c01781c16636c521f42698
• https://github.com/go-pkgz/auth/releases/tag/v1.25.2
• https://github.com/go-pkgz/auth/releases/tag/v2.1.2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner