CVE-2026-106488

Published: Oct 6, 2026Modified: Oct 22, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.

Affected (2)

Products: Linuxfoundation: Backstage/plugin Auth Backend Module Oidc Provider, Backstage

Linuxfoundation

2 products

Backstage/plugin Auth Backend Module Oidc Provider

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Backstage/plugin Auth Backend Module Oidc Provider	version < 0.4.20

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Backstage	version < 1.54.6

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (3)

https://github.com/backstage/backstage/commit/1b1f05e82161aaabc226c1d7d498d746956bf942

Source: security-advisories@github.com

Patch

https://github.com/backstage/backstage/releases/tag/v1.54.6

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg

Source: security-advisories@github.com

MitigationVendor Advisory

Timeline

No history available yet.