OauthCVE-2026-42560 - go-pkgz/auth Patreon identity collisionMay 2, 2026CVE-2026-41574 - Nhost OAuth email verification bypassMay 2, 2026