OAuth2 Authentication Flaw in Patreon Provider for Go-Pkgz Auth Library
CVE-2026-42560
9.1CRITICAL
What is CVE-2026-42560?
The Go-Pkgz Auth library experiences a significant vulnerability within its Patreon OAuth provider. In affected versions, authentication incorrectly maps all authenticated Patreon accounts to a single local user ID instead of generating unique identifiers for each account. This design flaw may result in multiple independent users being incorrectly represented as the same local identity. Consequently, this can cause severe issues such as unauthorized cross-account access and subscription state leakage, thus compromising user data integrity. The vulnerability has been addressed in versions 1.25.2 and 2.1.2.
Affected Version(s)
auth >= 1.18.0, < 1.25.2 < 1.18.0, 1.25.2
auth >= 2.0.0, < 2.1.2 < 2.0.0, 2.1.2