CVE-2026-106460

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106460

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	>= 1.18.0, < 1.49.7
backstage	backstage	>= 1.50.0-next.0, < 1.54.7
@backstage	plugin-auth-node	>= 0.3.0, < 0.6.15
@backstage	plugin-auth-node	>= 0.7.0, < 0.7.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Backstage versions 0.3.0 to 0.6.15 and 0.7.5 have a flaw in the @backstage/plugin-auth-node package where email verification is not consistently enforced during OAuth profile normalization. This allows an attacker to impersonate another user by supplying an unverified email address that matches a target user's email.

Detection Guidance

Check Backstage version with npm list @backstage/plugin-auth-node. If version is between 0.3.0 and 0.6.14 or 0.7.0 and 0.7.4, the system is vulnerable.

Impact Analysis

An attacker could gain unauthorized access to another user's account, obtain their permissions, and access sensitive resources or data. This requires the attacker to control an identity provider account that can supply or modify an unverified email matching a target user.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's access control requirements. Organizations using affected Backstage versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade @backstage/plugin-auth-node to version 0.6.15 or 0.7.5 or later. Review OAuth profile normalization settings to ensure explicit negative email verification is honored.

Hi! I’m here to help you understand CVE-2026-106460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70