{"id":"CVE-2026-106488","published":"2026-10-06T21:17:17.623","lastModified":"2026-10-07T19:17:32.773","description":"Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/1b1f05e82161aaabc226c1d7d498d746956bf942","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/1b1f05e82161aaabc226c1d7d498d746956bf942","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated OIDC users to impersonate other catalog identities when email-based identity resolution is used with unverified emails, potentially granting unauthorized access to user permissions and data. This is a privilege escalation issue in the authentication system.","exploitability":"Exploitation requires an authenticated OIDC session with a provider that allows unverified emails, and the attacker must know or guess another user's email address to impersonate them, making it moderately difficult but not highly complex.","blast_radius":"The impact could be significant across all Backstage deployments using OIDC with email-based identity resolution, potentially allowing attackers to access sensitive project data, permissions, and catalog resources as other users.","remediation":"Upgrade to version 0.4.20 or later to fix the improper authentication in the OIDC provider.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","oidc","identity-management"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:52.342Z"}}