Summary
Backstage: Improper authentication in the OIDC provider
Advisory details
Impact
Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated.
Patches
Patched in @backstage/plugin-auth-backend-module-oidc-provider version 0.4.20.
Workarounds
- Disable email-based sign-in resolution for the OIDC provider, or require the identity provider to verify email addresses before allowing sign-in.
References
- https://github.com/advisories/GHSA-826h-28h9-65hg
- https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg
- https://nvd.nist.gov/vuln/detail/CVE-2026-106488
- https://github.com/backstage/backstage/commit/1b1f05e82161aaabc226c1d7d498d746956bf942
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-84312
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
- HIGHCVE-2026-84313
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
- HIGHCVE-2026-62367
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
- HIGHGHSA-68w4-83fh-f2w8
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
- HIGHCVE-2026-107808
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
- HIGHGHSA-r44w-v6gf-x3p6
pyLoad has an authentication bypass in API key validation (check_apikey cache)