Do Son 
A critical authentication vulnerability has been discovered in the popular auth library, a tool used by developers to integrate “social logins” from major platforms like Google, Microsoft, and Discord. The flaw, tracked as CVE-2026-42560, carries a CVSS score of 9.1 and effectively erases the boundaries between individual users.
The vulnerability specifically targets the Patreon OAuth provider, causing a catastrophic “identity collision” where every single person who logs in via Patreon is assigned the exact same local user ID.
In a standard OAuth exchange, an application receives a unique identifier from the provider (Patreon) and maps it to a unique local account. However, due to a logic error in the library’s code, the system fails to derive this unique key from the incoming Patreon data.
Instead of generating a unique fingerprint, the library maps every authenticated Patreon account to the same static local identity. In practice, this means all Patreon-authenticated users of an application are collapsed into one single identity.
The Practical Impact includes:
- Cross-User Impersonation: Unrelated users can find themselves logged into the same account.
- Subscription Leakage: Patreon-specific attributes, such as is_paid_sub, can leak across accounts, granting paid features to non-subscribers. Data Corruption: Personal data associated with one user may be exposed to or overwritten by another.
- Privilege Escalation: If an administrator grants elevated permissions to a Patreon-linked account, those privileges effectively apply to every user who logs in via Patreon.
The root cause of the vulnerability was traced to how the library attempted to hash the user’s ID. The original code attempted to pull the ID from an uninitialized destination struct rather than the JSON data returned by Patreon’s API.
Security researchers have highlighted the specific fix required in provider/providers.go, changing the ID derivation from a generic struct field to the specific uinfoJSON.Data.ID returned by Patreon.
This vulnerability impacts applications using specific versions of the Go-based auth library:
- Auth (v1): Versions >= 1.18.0 through <= 1.25.1.
- Auth (v2): Versions >= 2.0.0 through <= 2.1.1.
Developers are urged to upgrade to authv2 2.1.2 or later to patch the flaw. Because this bug likely resulted in merged accounts, maintainers are also encouraged to provide migration guidance for users who may have already had their data mixed under the broken identifier.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
