CVE-2026-106488

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106488

EUVD

EUVD-2026-94007

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-auth-backend-module-oidc-provider	< 0.4.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @backstage/plugin-auth-backend-module-oidc-provider package in Backstage versions prior to 0.4.20. It involves improper authentication in the OIDC provider where email-based identity resolution allows an authenticated user to assume another catalog identity if the provider permits unverified email addresses. This could grant unauthorized access and permissions.

Detection Guidance

To detect this vulnerability, check if your Backstage deployment uses the @backstage/plugin-auth-backend-module-oidc-provider package version before 0.4.20. Inspect package.json or run npm list @backstage/plugin-auth-backend-module-oidc-provider to verify the installed version.

Impact Analysis

An attacker could exploit this to gain access to another user's account and permissions, potentially leading to unauthorized actions within the Backstage portal. However, there is no direct impact on system availability.

Compliance Impact

The vulnerability may lead to unauthorized access to user identities and permissions, potentially violating data protection requirements under GDPR and HIPAA. Specifically, improper authentication could allow an attacker to assume another user's identity, leading to unauthorized data access or processing, which conflicts with GDPR's principles of lawfulness and integrity and HIPAA's access control requirements.

Mitigation Strategies

Upgrade the @backstage/plugin-auth-backend-module-oidc-provider package to version 0.4.20 or later. Review OIDC provider configurations to ensure email verification is enforced for all users to prevent identity spoofing.

Hi! I’m here to help you understand CVE-2026-106488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70