Invalid Provider Data Vulnerability in GoTrue
Summary
GO-2022-0365: User object created with invalid provider data in GoTrue in github.com/netlify/gotrue. Affects github.com/netlify/gotrue versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoTrue is a package in the Go ecosystem that provides an authentication and user management system. It is commonly used in web applications to handle user authentication and authorization. This vulnerability affects the github.com/netlify/gotrue package.
Vulnerability Detail
The vulnerability arises from the creation of a user object with invalid provider data in GoTrue. This can lead to various security issues, such as unauthorized access or privilege escalation. Attackers may exploit this vulnerability to gain unauthorized access to user accounts or perform actions on behalf of other users.
How To Fix
Latest published version: v1.0.1 as of 23 Oct 2026
go get github.com/netlify/gotrue@v1.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.1
This is the first release that contains the fix.
go get github.com/netlify/gotrue@v1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
The invalid provider data vulnerability in GoTrue can lead to unauthorized access and other security risks. It is crucial to update the affected package to version 1.0.1 or later to mitigate these risks. No known workarounds or temporary measures are available, so updating the package is the recommended course of action.
See every vulnerability recorded for github.com/netlify/gotrue →
FAQ
The vulnerability can potentially allow attackers to gain unauthorized access to user accounts or perform actions on behalf of other users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is essential to update the package to the fixed version to mitigate any potential risks.
Unfortunately, there are no known temporary measures or workarounds for this vulnerability. It is highly recommended to update the package to the fixed version as soon as possible.
You can find more details about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2022-0365.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/netlify/gotrue.
