Vulnerability-Lookup

GHSA-XM5Q-P7W3-X6CP

Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23

Summary

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Details

Impact

Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The ID-token-only fallback likewise did not consistently respect email_verified: false.

Exploitation requires a deployment where an admitted identity-provider user can supply or change an email address without verification and Backstage uses that profile email to resolve catalog identities. In that configuration, the user may be able to assume another catalog identity and obtain its associated access and permissions.

An absent email_verified claim is not by itself considered an affected condition. Some providers rely on authoritative organizational provisioning and intentionally omit the optional claim. Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address, either through provider verification or trusted immutable provisioning.

This advisory covers the shared Passport profile normalization path when the selected profile email itself carries verified: false, when a matching raw provider email carries email_verified: false, or when an email obtained only from an ID token carries email_verified: false. It does not apply verification metadata from a different address or from a separate ID token to an independently fetched provider-profile email.

The generic OIDC provider follows a separate profile transform and is covered by GHSA-826h-28h9-65hg. The two advisories are complementary; deployments using both affected paths should apply both package updates. VMware Cloud uses a separate custom token transformation and is not changed by this patch.

Patches

Fixed in @backstage/plugin-auth-node versions 0.6.15 and 0.7.5. Users remaining on the 0.6.x line should upgrade to at least 0.6.15; users on 0.7.x should upgrade to at least 0.7.5.

The patched packages were released with Backstage v1.49.7 and Backstage v1.54.7, respectively. The fix is also present on master in commit 507e65a.

Workarounds

Require the identity provider to verify user-controlled email addresses before allowing sign-in.
Ensure profile emails are immutable and provisioned from a trusted organizational source.
Use a sign-in resolver that does not depend on the profile email.
Use a custom profile transform that omits an email when matching provider metadata explicitly marks it as unverified.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-auth-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.6.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-auth-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.0"
            },
            {
              "fixed": "0.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106460"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:23:52Z",
    "nvd_published_at": "2026-10-06T21:17:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nSeveral Passport-based authentication providers use shared OAuth profile normalization from `@backstage/plugin-auth-node`. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The ID-token-only fallback likewise did not consistently respect `email_verified: false`.\n\nExploitation requires a deployment where an admitted identity-provider user can supply or change an email address without verification and Backstage uses that profile email to resolve catalog identities. In that configuration, the user may be able to assume another catalog identity and obtain its associated access and permissions.\n\nAn absent `email_verified` claim is not by itself considered an affected condition. Some providers rely on authoritative organizational provisioning and intentionally omit the optional claim. Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address, either through provider verification or trusted immutable provisioning.\n\nThis advisory covers the shared Passport profile normalization path when the selected profile email itself carries `verified: false`, when a matching raw provider email carries `email_verified: false`, or when an email obtained only from an ID token carries `email_verified: false`. It does not apply verification metadata from a different address or from a separate ID token to an independently fetched provider-profile email.\n\nThe generic OIDC provider follows a separate profile transform and is covered by [GHSA-826h-28h9-65hg](https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg). The two advisories are complementary; deployments using both affected paths should apply both package updates. VMware Cloud uses a separate custom token transformation and is not changed by this patch.\n\n### Patches\n\nFixed in `@backstage/plugin-auth-node` versions `0.6.15` and `0.7.5`. Users remaining on the `0.6.x` line should upgrade to at least `0.6.15`; users on `0.7.x` should upgrade to at least `0.7.5`.\n\nThe patched packages were released with [Backstage v1.49.7](https://github.com/backstage/backstage/releases/tag/v1.49.7) and [Backstage v1.54.7](https://github.com/backstage/backstage/releases/tag/v1.54.7), respectively. The fix is also present on `master` in [commit 507e65a](https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb).\n\n### Workarounds\n\n- Require the identity provider to verify user-controlled email addresses before allowing sign-in.\n- Ensure profile emails are immutable and provisioned from a trusted organizational source.\n- Use a sign-in resolver that does not depend on the profile email.\n- Use a custom profile transform that omits an email when matching provider metadata explicitly marks it as unverified.",
  "id": "GHSA-xm5q-p7w3-x6cp",
  "modified": "2026-10-07T20:23:52Z",
  "published": "2026-10-07T20:23:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106460"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization"
}

CVE-2026-106460 (GCVE-0-2026-106460)

Vulnerability from cvelistv5 – Published: 2026-10-06 20:22 – Updated: 2026-10-06 20:22

Title

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Summary

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/backstage/backstage/security/a…	x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/507…	x_refsource_MISC
https://github.com/backstage/backstage/commit/f0a…	x_refsource_MISC
https://github.com/backstage/backstage/commit/fc5…	x_refsource_MISC
https://github.com/backstage/backstage/releases/t…	x_refsource_MISC
https://github.com/backstage/backstage/releases/t…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
backstage	backstage	Affected: >= 1.18.0, < 1.49.7 Affected: >= 1.50.0-next.0, < 1.54.7
@backstage	plugin-auth-node	Affected: >= 0.3.0, < 0.6.15 Affected: >= 0.7.0, < 0.7.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.18.0, \u003c 1.49.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.50.0-next.0, \u003c 1.54.7"
            }
          ]
        },
        {
          "product": "plugin-auth-node",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.3.0, \u003c 0.6.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.7.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T20:22:31.994Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.49.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.49.7"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.7"
        }
      ],
      "source": {
        "advisory": "GHSA-xm5q-p7w3-x6cp",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106460",
    "datePublished": "2026-10-06T20:22:31.994Z",
    "dateReserved": "2026-10-06T16:49:40.591Z",
    "dateUpdated": "2026-10-06T20:22:31.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted