GO-2026-6216

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6216

Import Source

https://vuln.go.dev/ID/GO-2026-6216.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6216

Published

2026-08-18T18:05:09Z

Modified

2026-08-18T21:30:14.256811575Z

Summary

Cross-forge account takeover on login in codefloe.com/crowci/crow/v6

Details

In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an attacker can take over arbitrary Crow accounts by registering matching credentials on any connected forge.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6216"
}

References

Credits

- Cassandra Beelen (sapphiccode)

Affected packages

Go / codefloe.com/crowci/crow/v6

Package

Name: codefloe.com/crowci/crow/v6; View open source insights on deps.dev
Purl: pkg:golang/codefloe.com/crowci/crow/v6

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.4.0

Ecosystem specific

{
    "imports": [
        {
            "path": "codefloe.com/crowci/crow/v6/server/api",
            "symbols": [
                "HandleAuth"
            ]
        },
        {
            "path": "codefloe.com/crowci/crow/v6/server/store/datastore",
            "symbols": [
                "storage.GetUserRemoteID"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6216.json"