Executive brief
A vulnerability in the go-pkgz/auth library causes all users who log in via Patreon to be assigned the exact same internal identity. This means that any application using this library for Patreon authentication will treat every Patreon user as the same person, potentially allowing users to access each other's private data, account settings, or subscription benefits. This flaw effectively breaks account isolation for anyone using the Patreon login method.
Technical details
An authentication bypass and identity collision vulnerability exists in the Patreon OAuth provider of the go-pkgz/auth library. The root cause is a logic error in the mapUser function where the code attempts to hash an uninitialized, empty string field (userInfo.ID) instead of the unique Patreon account ID returned in the OAuth response. Consequently, every Patreon user is assigned the identical hashed ID 'patreon_da39a3ee5e6b4b0d3255bfef95601890afd80709'. Remote attackers can exploit this to impersonate other Patreon users or access data associated with the shared identity. The issue is fixed in versions 1.25.2 and 2.1.2 by correctly hashing the uinfoJSON.Data.ID field.
Affected products
- go-pkgz auth >= 1.18.0, < 1.25.2
- go-pkgz auth/v2 >= 2.0.0, < 2.1.2
Timeline
- 2026-04-22: patched: Versions 1.25.2 and 2.1.2 released
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-09: disclosed: NVD publication date