CVE-2026-106460 backstage CVE debrief

Who should care

Operators and administrators using Backstage with email-based sign-in resolution must assess exposure and verify configurations. This includes reviewing and updating @backstage/plugin-auth-node to the latest version, ensuring that the configured provider restricts sign-in to the intended user population, and supplying an authoritative email address.

Why it matters

CVE-2026-106460 allows an attacker to assume another user's identity and gain access to their permissions if certain conditions are met. Defenders should verify configurations and update vulnerable versions.

• Potential unauthorized access to sensitive information and systems.
• Possible elevation of privileges for malicious users.
• Risk of data breaches or unauthorized modifications.
• Need for verification of email-based sign-in configurations.

Technical summary

The @backstage/plugin-auth-node package is vulnerable to explicit negative email verification being ignored during shared OAuth profile normalization. This can allow an admitted identity-provider user to assume another catalog identity and obtain its associated access and permissions if the deployment allows an identity-provider user to supply or change an email address without verification. Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address.

Defensive priority

Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address.

Recommended defensive actions

• Review and update @backstage/plugin-auth-node to version 0.6.15 or later for installations using npm.
• Review and update @backstage/plugin-auth-node to version 0.7.5 or later for installations using npm version 0.7.0 or later.
• Ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The source corpus provides details on the vulnerability in @backstage/plugin-auth-node, where explicit negative email verification can be ignored during shared OAuth profile normalization. The vulnerability allows an admitted identity-provider user to assume another catalog identity and obtain its associated access and permissions if the deployment allows an identity-provider user to supply or change an email address without verification. Defenders should verify configurations and update vulnerable versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.