Detections
Analytics

SCA: security update for github.com/go-pkgz/auth, github.com/go-pkgz/auth/v2 (GHSA-f6qq-3m3h-4g42)

critical Tenable Cloud Security Plugin ID 441044

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0
 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local
 user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. In practice, this
 means all Patreon-authenticated users of an application using this library are collapsed into a single
 local identity. Any application that trusts token.User.ID as the stable account key can end up mixing or
 fully merging unrelated Patreon users, which can lead to cross-account access, privilege confusion, and
 subscription-state leakage. This issue has been patched in versions 1.25.2 and 2.1.2. (CVE-2026-42560)

Solution

Update the github.com/go-pkgz/auth library and its related packages to version 1.25.2 or later.

See Also

https://github.com/advisories/GHSA-f6qq-3m3h-4g42

Plugin Details

Severity: Critical

ID: 441044

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/1/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-42560

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/30/2026

Vulnerability Publication Date: 4/30/2026

Reference Information

CVE: CVE-2026-42560

cwe: CWE-287