@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: GHSA-826H-28H9-65HG...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: SNYK:JS-BACKSTAGEPLUGINAUTHBACKENDMODULEOIDCPROVIDER-20826429...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: OSV:GHSA-826H-28H9-65HG...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

CVE-2026-106488

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: MEND:CVE-2026-106488...

CVE-2026-106488 Backstage: Improper authentication in the OIDC provider

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106488 Backstage: Improper authentication in the OIDC provider

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106488

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106488

The Backstage framework is vulnerable to improper authentication in the @backstage/plugin-auth-backend-module-oidc-provider package in versions prior to 0.4.20 . When using OIDC email-based identity resolution with a provider that allows unverified email addresses, an authenticated provider user ...

CVE-2026-106488 Backstage: Improper authentication in the OIDC provider

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106488: Improper Authentication

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

PT-2026-107269

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.4.20 Description The @backstage/plugin-auth-backend-module-oidc-provider package contains improper authentication within the OIDC provider. In deployments utilizing OIDC email-based identity resolution with a...

@backstage/plugin-auth-backend-module-aws-alb-provider (>=0.4.14-next.0, <=0.4.14-next.1), @backstage/plugin-auth-backend-module-oidc-provider (>=0.4.14-next.0, <=0.4.14-next.1) potentially affected by CVE-2026-32236 via @backstage/plugin-auth-backend (>=0.27.1-next.0, <=0.27.1-next.2)

@backstage/plugin-auth-backend NPM version =0.27.1-next.0, =0.4.14-next.0, =0.4.14-next.0, =0.4.14-next.1 Source cves: CVE-2026-32236 Source advisory: SNYK:JS-BACKSTAGEPLUGINAUTHBACKEND-15479717...