Read the docs
TI-2026-30840 Aliases CVE-2026-42560GHSA-f6qq-3m3h-4g42

Improper authentication in go-pkgz auth

Priority HIGH 78CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. In practice, this means all Patreon-authenticated users of an application using this library are collapsed into a single local identity. Any application that trusts token.User.ID as the stable account key can end up mixing or fully merging unrelated Patreon users, which can lead to cross-account access, privilege confusion, and subscription-state leakage. This issue has been patched in versions 1.25.2 and 2.1.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed auth (go-pkgz): 1.25.2, 2.1.2github.com/go-pkgz/auth (Go): 1.25.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-pkgzauth1.18.0 to before 1.25.2; 2.0.0 to before 2.1.21.25.2, 2.1.2Patch availableCNA
—github.com/go-pkgz/auth (Go)1.18.0 to before 1.25.21.25.2Patch availableGHSA-f6qq-3m3h-4g42
—github.com/go-pkgz/auth/v2 (Go)2.0.0 to before 2.1.22.1.2Patch availableGHSA-f6qq-3m3h-4g42
  • auth Vendorgo-pkgz Affected 1.18.0 to before 1.25.2; 2.0.0 to before 2.1.2 Fixed in 1.25.2, 2.1.2 Patch available CNA
  • github.com/go-pkgz/auth (Go) Vendor— Affected 1.18.0 to before 1.25.2 Fixed in 1.25.2 Patch available GHSA-f6qq-3m3h-4g42
  • github.com/go-pkgz/auth/v2 (Go) Vendor— Affected 2.0.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-f6qq-3m3h-4g42

Remediation

  • Fix · CNA auth (go-pkgz) Fixed in 1.25.2, 2.1.2
  • Fix · GHSA-f6qq-3m3h-4g42 github.com/go-pkgz/auth (Go) Fixed in 1.25.2 Advisory →
  • Fix · GHSA-f6qq-3m3h-4g42 github.com/go-pkgz/auth/v2 (Go) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42560
  2. 2026-10-03 Alias added: GHSA-f6qq-3m3h-4g42

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences