GO-2026-6216
Cross-forge account takeover on login in codefloe.com/crowci/crow/v6
In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an attacker can take over arbitrary Crow accounts by registering matching credentials on any connected forge.
What each source reports
OSV No score
Cross-forge account takeover on login in codefloe.com/crowci/crow/v6
In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an attacker can take over arbitrary Crow accounts by registering matching credentials on any connected forge.
- Record
GO-2026-6216- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
codefloe.com/crowci/crow/v6Go |
before 6.4.0 | 6.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GO-2026-6216 is a vulnerability with no CVSS score yet in codefloe.com/crowci/crow/v6, published August 18, 2026. No source lists public exploit code. Fixed in codefloe.com/crowci/crow/v6 6.4.0.