EUVD-2026-94007
GHSA-826h-28h9-65hg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-facing OIDC login with low complexity; PR:L because the attacker needs a valid provider account; identity assumption gives C:H/I:H, no availability impact so A:N, scope unchanged within Backstage.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.
AnalysisAI
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 lets an authenticated user of a configured OIDC identity provider impersonate another catalog identity. Exploitation requires a deployment that resolves sign-in identities by matching the OIDC email claim AND an identity provider that issues email addresses without asserting email_verified=true, in which case the attacker's unverified, self-controlled email can match a victim's catalog identity and inherit that identity's access and permissions (CVSS 3.1 base 8.1, PR:L, no availability impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires THREE concurrent conditions: (1) the Backstage deployment uses the @backstage/plugin-auth-backend-module-oidc-provider with an email-based sign-in/identity resolver that matches catalog identities on the email claim; (2) the configured OIDC identity provider issues email claims without setting email_verified=true (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-substantiated authentication flaw (CWE-287) rather than inflated CVSS noise, but its real-world priority is gated by configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @backstage/plugin-auth-backend-module-oidc-provider to 0.4.20 or later, which ships in Backstage release v1.54.6 (advisory GHSA-826h-28h9-65hg, commit 1b1f05e82161aaabc226c1d7d498d746956bf942) and causes the default profile transform to include an email only when the IdP sets email_verified=true. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Backstage deployment running @backstage/plugin-auth-backend-module-oidc-provider below version 0.4.20, determine whether that deployment resolves sign-in identities by matching the OIDC email claim, and confirm with identity-provider administrators whether the IdP issues email addresses without asserting email_verified=true; where unverified email addresses are accepted, immediately reconfigure the IdP to require email_verified or restrict accepted addresses to owned corporate domains, and, if that cannot be done the same day, disable email-based identity matching in favor of a subject/immutable-claim mapping. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-t
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today