CVE-2026-42560

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42560
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42560.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42560
Aliases
Published
2026-05-09T04:15:01.408Z
Modified
2026-07-15T01:49:21.749908748Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation
Details

auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. In practice, this means all Patreon-authenticated users of an application using this library are collapsed into a single local identity. Any application that trusts token.User.ID as the stable account key can end up mixing or fully merging unrelated Patreon users, which can lead to cross-account access, privilege confusion, and subscription-state leakage. This issue has been patched in versions 1.25.2 and 2.1.2.

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42560.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/go-pkgz/auth

Affected ranges

Type
GIT
Repo
https://github.com/go-pkgz/auth
Events
Introduced
3387ae616d964110aed20c24b12b62d511810569
Fixed
c0b15ee72a8401da83c01781c16636c521f42698
Introduced
ea5d5444cc3ef91ed09d6252ad637bd8a6e2b515
Fixed
c0b15ee72a8401da83c01781c16636c521f42698
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.18.0"
        },
        {
            "fixed": "1.25.2"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.0.0
v2.1.0
v2.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42560.json"