Vulnerability-Lookup

CVE-2026-106460 (GCVE-0-2026-106460)

Vulnerability from cvelistv5 – Published: 2026-10-06 20:22 – Updated: 2026-10-09 01:48

Title

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Summary

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 01:47 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/backstage/backstage/security/a…	x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/507…	x_refsource_MISC
https://github.com/backstage/backstage/commit/f0a…	x_refsource_MISC
https://github.com/backstage/backstage/commit/fc5…	x_refsource_MISC
https://github.com/backstage/backstage/releases/t…	x_refsource_MISC
https://github.com/backstage/backstage/releases/t…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
backstage	backstage	Affected: >= 1.18.0, < 1.49.7 Affected: >= 1.50.0-next.0, < 1.54.7
@backstage	plugin-auth-node	Affected: >= 0.3.0, < 0.6.15 Affected: >= 0.7.0, < 0.7.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106460",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T01:47:50.662934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T01:48:01.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.18.0, \u003c 1.49.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.50.0-next.0, \u003c 1.54.7"
            }
          ]
        },
        {
          "product": "plugin-auth-node",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.3.0, \u003c 0.6.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.7.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T20:22:31.994Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.49.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
        }
      ],
      "source": {
        "advisory": "GHSA-xm5q-p7w3-x6cp",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106460",
    "datePublished": "2026-10-06T20:22:31.994Z",
    "dateReserved": "2026-10-06T16:49:40.591Z",
    "dateUpdated": "2026-10-09T01:48:01.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106460",
      "date": "2026-10-15",
      "epss": "0.00313",
      "percentile": "0.22641"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "backstage",
                "vendor": "backstage",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.18.0, \u003c 1.49.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.50.0-next.0, \u003c 1.54.7"
                  }
                ]
              },
              {
                "product": "plugin-auth-node",
                "vendor": "@backstage",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.3.0, \u003c 0.6.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.7.0, \u003c 0.7.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5."
          }
        ],
        "id": "CVE-2026-106460",
        "lastModified": "2026-10-09T02:17:00.153",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-106460",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T01:47:50.662934Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T21:17:16.707",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-07T12:02:08+00:00",
      "cve": "CVE-2026-106460",
      "id": "CVE-2026-106460",
      "initial_release_date": "2026-10-06T20:22:31.994000+00:00",
      "product_status:known_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@backstage/plugin-auth-node: @backstage/plugin-auth-node: Privilege escalation via improper email verification",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106460.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-106460",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-09T01:47:50.662934Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-09T01:47:57.727Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "backstage",
              "vendor": "backstage",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.18.0, \u003c 1.49.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.50.0-next.0, \u003c 1.54.7"
                }
              ]
            },
            {
              "product": "plugin-auth-node",
              "vendor": "@backstage",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 0.3.0, \u003c 0.6.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.7.0, \u003c 0.7.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287: Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T20:22:31.994Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
            },
            {
              "name": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
            },
            {
              "name": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
            },
            {
              "name": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
            },
            {
              "name": "https://github.com/backstage/backstage/releases/tag/v1.49.7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
            },
            {
              "name": "https://github.com/backstage/backstage/releases/tag/v1.54.7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
            }
          ],
          "source": {
            "advisory": "GHSA-xm5q-p7w3-x6cp",
            "discovery": "UNKNOWN"
          },
          "title": "Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-106460",
        "datePublished": "2026-10-06T20:22:31.994Z",
        "dateReserved": "2026-10-06T16:49:40.591Z",
        "dateUpdated": "2026-10-09T01:48:01.580Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-384032

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-06 21:16

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-06T21:16:03.212068+00:00",
  "id": "EUVD-2026-384032"
}

FKIE_CVE-2026-106460

Vulnerability from fkie_nvd - Published: 2026-10-06 21:17 - Updated: 2026-10-09 02:17

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb
	security-advisories@github.com	https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38
	security-advisories@github.com	https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d
	security-advisories@github.com	https://github.com/backstage/backstage/releases/tag/v1.49.7
	security-advisories@github.com	https://github.com/backstage/backstage/releases/tag/v1.54.7
	security-advisories@github.com	https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.18.0, \u003c 1.49.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.50.0-next.0, \u003c 1.54.7"
            }
          ]
        },
        {
          "product": "plugin-auth-node",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.3.0, \u003c 0.6.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.7.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5."
    }
  ],
  "id": "CVE-2026-106460",
  "lastModified": "2026-10-09T02:17:00.153",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106460",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-09T01:47:50.662934Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T21:17:16.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XM5Q-P7W3-X6CP

Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23

Summary

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Details

Impact

Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The ID-token-only fallback likewise did not consistently respect email_verified: false.

Exploitation requires a deployment where an admitted identity-provider user can supply or change an email address without verification and Backstage uses that profile email to resolve catalog identities. In that configuration, the user may be able to assume another catalog identity and obtain its associated access and permissions.

An absent email_verified claim is not by itself considered an affected condition. Some providers rely on authoritative organizational provisioning and intentionally omit the optional claim. Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address, either through provider verification or trusted immutable provisioning.

This advisory covers the shared Passport profile normalization path when the selected profile email itself carries verified: false, when a matching raw provider email carries email_verified: false, or when an email obtained only from an ID token carries email_verified: false. It does not apply verification metadata from a different address or from a separate ID token to an independently fetched provider-profile email.

The generic OIDC provider follows a separate profile transform and is covered by GHSA-826h-28h9-65hg. The two advisories are complementary; deployments using both affected paths should apply both package updates. VMware Cloud uses a separate custom token transformation and is not changed by this patch.

Patches

Fixed in @backstage/plugin-auth-node versions 0.6.15 and 0.7.5. Users remaining on the 0.6.x line should upgrade to at least 0.6.15; users on 0.7.x should upgrade to at least 0.7.5.

The patched packages were released with Backstage v1.49.7 and Backstage v1.54.7, respectively. The fix is also present on master in commit 507e65a.

Workarounds

Require the identity provider to verify user-controlled email addresses before allowing sign-in.
Ensure profile emails are immutable and provisioned from a trusted organizational source.
Use a sign-in resolver that does not depend on the profile email.
Use a custom profile transform that omits an email when matching provider metadata explicitly marks it as unverified.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-auth-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.6.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-auth-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.0"
            },
            {
              "fixed": "0.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106460"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:23:52Z",
    "nvd_published_at": "2026-10-06T21:17:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nSeveral Passport-based authentication providers use shared OAuth profile normalization from `@backstage/plugin-auth-node`. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The ID-token-only fallback likewise did not consistently respect `email_verified: false`.\n\nExploitation requires a deployment where an admitted identity-provider user can supply or change an email address without verification and Backstage uses that profile email to resolve catalog identities. In that configuration, the user may be able to assume another catalog identity and obtain its associated access and permissions.\n\nAn absent `email_verified` claim is not by itself considered an affected condition. Some providers rely on authoritative organizational provisioning and intentionally omit the optional claim. Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address, either through provider verification or trusted immutable provisioning.\n\nThis advisory covers the shared Passport profile normalization path when the selected profile email itself carries `verified: false`, when a matching raw provider email carries `email_verified: false`, or when an email obtained only from an ID token carries `email_verified: false`. It does not apply verification metadata from a different address or from a separate ID token to an independently fetched provider-profile email.\n\nThe generic OIDC provider follows a separate profile transform and is covered by [GHSA-826h-28h9-65hg](https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg). The two advisories are complementary; deployments using both affected paths should apply both package updates. VMware Cloud uses a separate custom token transformation and is not changed by this patch.\n\n### Patches\n\nFixed in `@backstage/plugin-auth-node` versions `0.6.15` and `0.7.5`. Users remaining on the `0.6.x` line should upgrade to at least `0.6.15`; users on `0.7.x` should upgrade to at least `0.7.5`.\n\nThe patched packages were released with [Backstage v1.49.7](https://github.com/backstage/backstage/releases/tag/v1.49.7) and [Backstage v1.54.7](https://github.com/backstage/backstage/releases/tag/v1.54.7), respectively. The fix is also present on `master` in [commit 507e65a](https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb).\n\n### Workarounds\n\n- Require the identity provider to verify user-controlled email addresses before allowing sign-in.\n- Ensure profile emails are immutable and provisioned from a trusted organizational source.\n- Use a sign-in resolver that does not depend on the profile email.\n- Use a custom profile transform that omits an email when matching provider metadata explicitly marks it as unverified.",
  "id": "GHSA-xm5q-p7w3-x6cp",
  "modified": "2026-10-07T20:23:52Z",
  "published": "2026-10-07T20:23:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106460"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106460 (GCVE-0-2026-106460)

EUVD-2026-384032

FKIE_CVE-2026-106460

GHSA-XM5Q-P7W3-X6CP

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Related by attack behaviour