—

GO-2026-6216

Cross-forge account takeover on login in codefloe.com/crowci/crow/v6

Quick fix

GO-2026-6216 — codefloe.com/crowci/crow/v6: upgrade to the fixed version with the command below.

go get codefloe.com/crowci/crow/v6@v6.4.0

Details

In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an attacker can take over arbitrary Crow accounts by registering matching credentials on any connected forge.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / codefloe.com/crowci/crow/v6

Introduced in: 0 Fixed in: 6.4.0

Fix go get codefloe.com/crowci/crow/v6@v6.4.0

References

https://codefloe.com/crowci/crow/src/branch/main/security/advisories/cross-forge-account-takeover.md [ADVISORY]
https://codefloe.com/crowci/crow/commit/6b4405f1ef0126e5074383e551ae38d55c2a7efe [FIX]
https://codefloe.com/crowci/crow/releases/tag/v6.4.0 [WEB]