The go-pkgz auth library's Patreon OAuth integration suffers from improper authentication (CWE-287) where it assigns the same local user ID to every Patreon-authenticated user instead of deriving a unique ID from the Patreon account. This flaw affects versions >=1.18.0 and <1.25.2, and >=2.0.0 and <2.1.2. Applications relying on token.User.ID as a stable account key may inadvertently merge distinct Patreon users, leading to unauthorized access and data leakage. The vulnerability has a CVSS 3.1 score of 9.1 (critical) and was patched in versions 1.25.2 and 2.1.2.

Exploiting this vulnerability allows an attacker authenticated via Patreon OAuth to be treated as the same user as all other Patreon-authenticated users, causing cross-account access and potential leakage of sensitive subscription information. This compromises confidentiality and integrity of user accounts but does not affect availability.

Upgrade the go-pkgz auth library to version 1.25.2 or later, or 2.1.2 or later, where the Patreon OAuth provider correctly derives unique user IDs. No other mitigation is indicated. Patch status is confirmed by the vendor advisory.