Plugin Auth Node
Monthly
Improper authentication in the Backstage @backstage/plugin-auth-node package (versions 0.3.0 through 0.6.14 and 0.7.x before 0.7.5) lets an already-admitted identity-provider user assume another catalog user's identity and inherit its access and permissions. The flaw is conditional and rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N): it only triggers when a deployment uses an email-based sign-in resolver that derives catalog identity from the selected profile email AND that email carries an explicit negative verification flag (profile email verified:false, a matching raw provider email_verified:false, or an ID-token-only email with email_verified:false) - an absent email_verified claim alone is not affected. Vendor-released patches exist in 0.6.15 and 0.7.5 (Backstage releases v1.49.7 and v1.54.7), and no public exploit or confirmed active exploitation was identified at time of analysis.
Improper authentication in the Backstage @backstage/plugin-auth-node package (versions 0.3.0 through 0.6.14 and 0.7.x before 0.7.5) lets an already-admitted identity-provider user assume another catalog user's identity and inherit its access and permissions. The flaw is conditional and rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N): it only triggers when a deployment uses an email-based sign-in resolver that derives catalog identity from the selected profile email AND that email carries an explicit negative verification flag (profile email verified:false, a matching raw provider email_verified:false, or an ID-token-only email with email_verified:false) - an absent email_verified claim alone is not affected. Vendor-released patches exist in 0.6.15 and 0.7.5 (Backstage releases v1.49.7 and v1.54.7), and no public exploit or confirmed active exploitation was identified at time of analysis.