Plugin Auth Backend Module Cloudflare Access Provider
Monthly
Insufficient audience validation in Backstage's Cloudflare Access auth provider package (@backstage/plugin-auth-backend-module-cloudflare-access-provider 0.1.0 through 0.4.x) lets a user who already holds a valid Cloudflare Access JWT issued for a different Access application inside the same Cloudflare Zero Trust team authenticate to Backstage, because the provider verifies the token signature and team issuer but never checks the token's audience (AUD) claim. Exploitation is conditional: the forged-context token must actually reach the Backstage auth endpoint on a path where Cloudflare Access has not already enforced the Backstage application's own AUD tag upstream, and the attacker must be an authenticated member of the shared Zero Trust team, which is why the assessed vector carries AC:H and PR:L and the resulting rating is a moderate, conditional authentication bypass rather than a top-tier priority. No public exploit code has been identified at time of analysis, and the issue is fixed in plugin version 0.5.0 (shipped with Backstage v1.55.0), where the 'audience' configuration value becomes mandatory.
Insufficient audience validation in Backstage's Cloudflare Access auth provider package (@backstage/plugin-auth-backend-module-cloudflare-access-provider 0.1.0 through 0.4.x) lets a user who already holds a valid Cloudflare Access JWT issued for a different Access application inside the same Cloudflare Zero Trust team authenticate to Backstage, because the provider verifies the token signature and team issuer but never checks the token's audience (AUD) claim. Exploitation is conditional: the forged-context token must actually reach the Backstage auth endpoint on a path where Cloudflare Access has not already enforced the Backstage application's own AUD tag upstream, and the attacker must be an authenticated member of the shared Zero Trust team, which is why the assessed vector carries AC:H and PR:L and the resulting rating is a moderate, conditional authentication bypass rather than a top-tier priority. No public exploit code has been identified at time of analysis, and the issue is fixed in plugin version 0.5.0 (shipped with Backstage v1.55.0), where the 'audience' configuration value becomes mandatory.