CVE-2026-42560: go-pkgz/auth Patreon OAuth: identity collapse into one user (improper authentication)
In affected versions of the go-pkgz/auth library, the Patreon OAuth provider maps every authenticated Patreon account to the same local user ID. This can merge unrelated Patreon users into one identity, which may lead to cross-account access and subscription-state exposure in applications that rely on that ID. The CNA lists a CVSS 3.1 base score of 9.1, and the fixed versions are 1.25.2 and 2.1.2.
Overview
CVE-2026-42560 affects the Patreon OAuth provider in the go-pkgz/auth library. According to the record, every authenticated Patreon account is mapped to the same local user.ID instead of a unique identifier derived from the Patreon account. The weakness is classified as improper authentication (CWE-287).
Impact
Because separate identities collapse into one, applications that treat token.User.ID as a stable account key may:
- mix data or sessions belonging to unrelated Patreon users;
- grant access or privileges meant for one account to another account;
- expose subscription-state information across accounts.
These outcomes are inferences from the description and depend on how each application uses the identifier.
Affected products and versions
- Versions from 1.18.0 up to, but not including, 1.25.2.
- Versions from 2.0.0 up to, but not including, 2.1.2.
The record's affected and fixes lists are empty, so this range is taken from the description text.
Exploitation status
The record shows the CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. The record includes an EPSS probability of 0.00579 and a percentile of 0.46159.
Remediation and mitigation
- Upgrade to 1.25.2 on the 1.x line or to 2.1.2 on the 2.x line.
- Until the upgrade is complete, review applications that use the Patreon provider and avoid relying on token.User.ID as a unique account key.
- Assess whether existing sessions or stored records were linked to a merged identity, and plan any cleanup carefully, since the record does not describe migration steps.
- Consult the GitHub advisory and the release notes for vendor details.
Detection guidance
- Review authentication logs for many distinct Patreon logins resolving to the same local user identifier.
- Watch for unexpected account changes or subscription-related views that follow logins.
Limitations of the available information
The record does not state how many deployments are affected, whether any workaround exists besides upgrading, or how merged identities should be migrated. Its source status is Deferred. The EPSS date in the record is later than the publication date, so its timing should be checked against the live data feed.
Frequently asked questions
Which versions are affected by CVE-2026-42560?
According to the record, versions from 1.18.0 up to before 1.25.2 and from 2.0.0 up to before 2.1.2 of the go-pkgz/auth library are affected.
What should I do if I use the Patreon provider?
Upgrade to 1.25.2 on the 1.x line or 2.1.2 on the 2.x line, and review whether your application treats token.User.ID as a unique account key.
Is this vulnerability being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.