9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42560

CVE-2026-42560: auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. In practice, this means all Patreon-authenticated users of an application using this library are collapsed into a single local identity. Any application that trusts token.User.ID as the stable account key can end up mixing or fully merging unrelated Patreon users, which can lead to cross-account access, privilege confusion, and subscription-state leakage. This issue has been patched in versions 1.25.2 and 2.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42560

CVE-2026-42560:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-pkgz/auth	go	>= 1.18.0, <= 1.25.1	1.25.2
github.com/go-pkgz/auth/v2	go	>= 2.0.0, <= 2.1.1	2.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Patreon authentication provider for go-pkgz/auth in both the v1 and v2 modules. The function responsible for mapping user information from Patreon to the application's user model (token.User) contains a critical flaw. Specifically, when generating a unique user ID, the code hashes the ID field of a newly created, empty token.User object (userInfo.ID). Since this field is always an empty string at this point, the resulting hash is always the same (da39a3ee5e6b4b0d3255bfef95601890afd80709).

This means every user authenticating via Patreon is assigned the identical user ID: patreon_da39a3ee5e6b4b0d3255bfef95601890afd80709.

As a result, any application using this library for Patreon authentication and relying on the provided user ID for account identification would treat all Patreon users as a single entity. This leads to a severe authentication bypass, allowing any Patreon user to access and manipulate the data of any other Patreon user within the application, effectively leading to cross-user impersonation and data leakage.

The vulnerable function is an anonymous function literal defined within NewPatreon and assigned to the mapUser field. A runtime profiler would likely identify this as provider.NewPatreon.func1. The fix, as seen in the patch, is to hash the correct identifier received from Patreon (uinfoJSON.Data.ID) instead of the empty local field.

Vulnerable functions

provider.NewPatreon.func1

provider/providers.go

This anonymous function, responsible for mapping Patreon user data to a local user object, incorrectly generates the user ID. It hashes the `userInfo.ID` field of a newly initialized `token.User` struct, which is always an empty string. This causes every Patreon user to be assigned the same static ID (`patreon_da39a3ee5e6b4b0d3255bfef95601890afd80709`), allowing any Patreon user to impersonate any other on the application. The fix involves hashing the actual user ID from the Patreon API response (`uinfoJSON.Data.ID`).

provider.NewPatreon.func1

v2/provider/providers.go

This anonymous function, in the v2 version of the provider, is responsible for mapping Patreon user data to a local user object. It incorrectly generates the user ID by hashing the `userInfo.ID` field of a newly initialized `token.User` struct, which is always an empty string. This causes every Patreon user to be assigned the same static ID (`patreon_da39a3ee5e6b4b0d3255bfef95601890afd80709`), allowing any Patreon user to impersonate any other on the application. The fix involves hashing the actual user ID from the Patreon API response (`uinfoJSON.Data.ID`).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.