—
GO-2026-6216
Cross-forge account takeover on login in codefloe.com/crowci/crow/v6
빠른 조치
GO-2026-6216 — codefloe.com/crowci/crow/v6: 아래 명령으로 수정 버전으로 올리세요.
go get codefloe.com/crowci/crow/v6@v6.4.0상세
In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an attacker can take over arbitrary Crow accounts by registering matching credentials on any connected forge.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Go / codefloe.com/crowci/crow/v6
최초 영향 버전:
0 수정 버전: 6.4.0 수정
go get codefloe.com/crowci/crow/v6@v6.4.0