Skip to content
OpenAdvisories

Package · Go

github.com/go-pkgz/auth

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.1
    CVE-2026-42560

    auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

    auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the…

    go-pkgz auth github.com/go-pkgz/auth/v2 github.com/go-pkgz/auth Go