Plugin Auth Backend Module Oidc Provider
Monthly
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 lets an authenticated user of a configured OIDC identity provider impersonate another catalog identity. Exploitation requires a deployment that resolves sign-in identities by matching the OIDC email claim AND an identity provider that issues email addresses without asserting email_verified=true, in which case the attacker's unverified, self-controlled email can match a victim's catalog identity and inherit that identity's access and permissions (CVSS 3.1 base 8.1, PR:L, no availability impact). No public exploit code has been identified at time of analysis, and the flaw is fixed by omitting the email from the default OIDC profile transform unless the provider explicitly marks it verified.
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 lets an authenticated user of a configured OIDC identity provider impersonate another catalog identity. Exploitation requires a deployment that resolves sign-in identities by matching the OIDC email claim AND an identity provider that issues email addresses without asserting email_verified=true, in which case the attacker's unverified, self-controlled email can match a victim's catalog identity and inherit that identity's access and permissions (CVSS 3.1 base 8.1, PR:L, no availability impact). No public exploit code has been identified at time of analysis, and the flaw is fixed by omitting the email from the default OIDC profile transform unless the provider explicitly marks it verified.