Backstage EUVD-2026-93990

Exploitation requires ALL of: (1) the attacker possesses a valid Cloudflare Access JWT issued for a DIFFERENT Access application within the SAME Cloudflare Zero Trust team; (2) that token can reach the Backstage @backstage/plugin-auth-backend-module-cloudflare-access-provider auth endpoint on a request path where Cloudflare Access has NOT already enforced the Backstage application's own Audience (AUD) tag upstream; and (3) a vulnerable version (>=0.1.0 and <0.5.0) is in use. Limiting factors: Cloudflare Access normally evaluates the protected application and enforces audience before forwarding, so a properly fronted deployment is not exploitable; the attacker must already be an authenticated member of the shared Zero Trust team; and the fixed version makes the 'audience' config value mandatory so the AUD claim is checked.

This is a moderate, conditional authentication-bypass issue (CWE-287) rather than a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.8 MEDIUM) is internally consistent with the description: network-reachable, but high attack complexity because success depends on a condition outside the attacker's direct control (the token reaching the Backstage auth endpoint without the Backstage application's audience already being enforced upstream by Cloudflare Access), and PR:L because the attacker must already hold a valid Cloudflare Access token for some other application in the same Zero Trust team. No EPSS score, KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by the structural auth weakness, not by observed attack activity. The key mitigating reality, stated by the vendor, is that Cloudflare Access normally evaluates the protected application before forwarding requests, so in a correctly fronted deployment the bypass does not trigger; exposure is highest where the auth endpoint can be reached on a path that skips per-application audience enforcement. Net: treat as a prompt-but-not-emergency patch, weighted up for engineering orgs that run this provider and front Backstage with a shared Zero Trust team.

An attacker who is a legitimate user of a different application within the same Cloudflare Zero Trust team obtains their own valid Access JWT. They submit that token to the Backstage auth endpoint on a path where Cloudflare Access has not already enforced the Backstage application's audience; affected versions (0.1.0-pre-0.5.0) validate only the token signature and team issuer, so authentication to Backstage succeeds. No public exploit code was identified in the provided data.