{"id":"CVE-2026-106460","revision":null,"records":[{"revision":"6b91d25a4dbc4fd8a3aa37959c46cb4c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106460","aliases":[],"title":"Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization","description":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.","state":0,"publishedAt":"2026-10-06T20:22:31.994+00:00","modifiedAt":"2026-10-09T01:48:01.58+00:00","affected":[{"ecosystem":"Vendor product","name":"backstage","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"backstage\",\n                    \"product\": \"backstage\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.18.0, < 1.49.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.50.0-next.0, < 1.54.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"plugin-auth-node","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@backstage\",\n                    \"product\": \"plugin-auth-node\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.3.0, < 0.6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.7.0, < 0.7.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp","https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb","https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38","https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d","https://github.com/backstage/backstage/releases/tag/v1.49.7","https://github.com/backstage/backstage/releases/tag/v1.54.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106460","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106460","identifiers":["CVE-2026-106460"]},"retained":false,"historicalAffected":[]},{"revision":"e0b236d357184d7d96ca9edaf95c3a66","observedAt":"2026-10-30T01:52:20.011+00:00","statement":{"source":"euvd","id":"EUVD-2026-93995","aliases":["CVE-2026-106460","GHSA-xm5q-p7w3-x6cp"],"title":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalizat…","description":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8,"severity":null}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp","https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb","https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38","https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d","https://github.com/backstage/backstage/releases/tag/v1.49.7","https://github.com/backstage/backstage/releases/tag/v1.54.7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93995","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 6, 2026, 8:22:31 PM","dateUpdated":"Oct 9, 2026, 1:48:01 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-93995","identifiers":["EUVD-2026-93995","CVE-2026-106460","GHSA-xm5q-p7w3-x6cp"]},"retained":false,"historicalAffected":[]},{"revision":"fe91c85123a342a09aad24307e2f28b5","observedAt":"2026-10-29T05:48:21.551+00:00","statement":{"source":"nvd","id":"CVE-2026-106460","aliases":[],"title":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalizat…","description":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.","state":0,"publishedAt":"2026-10-06T21:17:16.707+00:00","modifiedAt":"2026-10-27T20:41:12+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb","https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38","https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d","https://github.com/backstage/backstage/releases/tag/v1.49.7","https://github.com/backstage/backstage/releases/tag/v1.54.7","https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106460","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-287"],"productCriteria":["cpe:2.3:a:linuxfoundation:backstage\\/plugin-auth-node:*:*:*:*:*:node.js:*:*","cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-10-06T21:17:16.707","lastModified":"2026-10-27T20:41:12.000"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-106460","identifiers":["CVE-2026-106460"]},"retained":false,"historicalAffected":[]},{"revision":"f0ce3215cc76453cb5ecb3677fdbed20","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xm5q-p7w3-x6cp","aliases":["CVE-2026-106460"],"title":"Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization","description":"### Impact\n\nSeveral Passport-based authentication providers use shared OAuth profile normalization from `@backstage/plugin-auth-node`. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The ID-token-only fallback likewise did not consistently respect `email_verified: false`.\n\nExploitation requires a deployment where an admitted identity-provider user can supply or change an email address without verification and Backstage uses that profile email to resolve catalog identities. In that configuration, the user may be able to assume another catalog identity and obtain its associated access and permissions.\n\nAn absent `email_verified` claim is not by itself considered an affected condition. Some providers rely on authoritative organizational provisioning and intentionally omit the optional claim. Operators using email-based sign-in resolution must ensure that the configured provider restricts sign-in to the intended user population and supplies an authoritative email address, either through provider verification or trusted immutable provisioning.\n\nThis advisory covers the shared Passport profile normalization path when the selected profile email itself carries `verified: false`, when a matching raw provider email carries `email_verified: false`, or when an email obtained only from an ID token carries `email_verified: false`. It does not apply verification metadata from a different address or from a separate ID token to an independently fetched provider-profile email.\n\nThe generic OIDC provider follows a separate profile transform and is covered by [GHSA-826h-28h9-65hg](https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg). The two advisories are complementary; deployments using both affected paths should apply both package updates. VMware Cloud uses a separate custom token transformation and is not changed by this patch.\n\n### Patches\n\nFixed in `@backstage/plugin-auth-node` versions `0.6.15` and `0.7.5`. Users remaining on the `0.6.x` line should upgrade to at least `0.6.15`; users on `0.7.x` should upgrade to at least `0.7.5`.\n\nThe patched packages were released with [Backstage v1.49.7](https://github.com/backstage/backstage/releases/tag/v1.49.7) and [Backstage v1.54.7](https://github.com/backstage/backstage/releases/tag/v1.54.7), respectively. The fix is also present on `master` in [commit 507e65a](https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb).\n\n### Workarounds\n\n- Require the identity provider to verify user-controlled email addresses before allowing sign-in.\n- Ensure profile emails are immutable and provisioned from a trusted organizational source.\n- Use a sign-in resolver that does not depend on the profile email.\n- Use a custom profile transform that omits an email when matching provider metadata explicitly marks it as unverified.","state":0,"publishedAt":"2026-10-07T20:23:52+00:00","modifiedAt":"2026-10-07T20:30:06.8370068+00:00","affected":[{"ecosystem":"npm","name":"@backstage/plugin-auth-node","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.3.0"},{"kind":"fixed","version":"0.6.15"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@backstage/plugin-auth-node","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.7.0"},{"kind":"fixed","version":"0.7.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp","https://nvd.nist.gov/vuln/detail/CVE-2026-106460","https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb","https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38","https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.49.7","https://github.com/backstage/backstage/releases/tag/v1.54.7"],"sourceUrl":"https://github.com/advisories/GHSA-xm5q-p7w3-x6cp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xm5q-p7w3-x6cp","identifiers":["GHSA-xm5q-p7w3-x6cp","CVE-2026-106460"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-31T18:04:58.6482428+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-31T18:04:58.6482428+00:00","lastSuccessAt":"2026-10-31T18:04:58.7865206+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.7865223+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9266d7b009bf9c4a0ccdcb5cbdea7f905cb3c4d92fd3b41581ece16b2cfdc4e7-e759753099971461426134cf78f17ff9cadddbf5294634e64de8be315fbf0bc4","complete":true,"records":417580,"lastAttemptAt":"2026-10-31T18:04:58.0539149+00:00","lastSuccessAt":"2026-10-31T18:04:57.0112664+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.0539149+00:00","snapshotPublishedAt":"2026-10-31T17:26:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c212a40a511a4951adc0bec55822365e","complete":true,"records":13567,"lastAttemptAt":"2026-10-31T18:05:29.7469906+00:00","lastSuccessAt":"2026-10-31T18:05:29.742+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:05:29.742+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-31T18:04:58.6482428+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-31T18:04:58.6482428+00:00","lastSuccessAt":"2026-10-31T18:04:58.7872654+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.7872657+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2463a66e72cb466a9663c24ed11f7a19","complete":true,"records":13580,"lastAttemptAt":"2026-10-31T18:05:24.117639+00:00","lastSuccessAt":"2026-10-31T18:05:24.113+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:05:24.113+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-10-31T18:04:58.4995612+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.4995612+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-31T18:04:58.2062107+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.2062107+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-10-31T18:04:58.6058915+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.6058915+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-712291bb5a0ee4f1ca7325e317f98ff05e9ab8d14f863abf00a323d9e6d8331e","complete":true,"records":230994,"lastAttemptAt":"2026-10-31T18:04:58.3911753+00:00","lastSuccessAt":"2026-10-31T17:06:47.8999408+00:00","error":null,"lastVerifiedAt":"2026-10-31T18:04:58.3911753+00:00","snapshotPublishedAt":"2026-10-31T16:33:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}