@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

EUVD-2026-93990

Backstage: Insufficient audience validation in the Cloudflare Access auth provider...

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

GHSA-Q333-F498-W2X7 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

Improper Verification of Cryptographic Signature

Overview @backstage/plugin-auth-backend-module-cloudflare-access-provider is a The cloudflare-access-provider backend module for the auth plugin. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the jwtVerify call in helpers.ts, which verifi...

CVE-2026-106457

A flaw was found in the Backstage Cloudflare Access authentication provider module. This vulnerability allows an attacker to gain unauthorized access to the Backstage application. The provider verifies a token's signature and team issuer but fails to confirm that the token was issued for the...

CVE-2026-106457

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

CVE-2026-106457

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106457

The @backstage/plugin-auth-backend-module-cloudflare-access-provider package (versions &gt;=0.1.6-next.2 and

PT-2026-107246

Name of the Vulnerable Software and Affected Versions @backstage/plugin-auth-backend-module-cloudflare-access-provider versions 0.1.0 through 0.4.9 Description Insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for a different Access applicati...

CVE-2026-106457: Improper Authentication

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

Cloudflare Access - Login Panel Detection

Detected exposed Cloudflare Access login pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Cloudflare Access login pages.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cloudflare Access - Login...

Cloudflare Public Bug Bounty: [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth

A vulnerability was discovered in Cloudflare Access that could allow for unauthorized approvals within the Temporary Auth workflow. The issue was resolved after the researcher reported it to Cloudflare...

Unikrn: multiple vulnerabilities on your mautic server

Hi @unikrn! I found some vulnerabilities in you crm server: 1. By pass Cloudflare access: You Use Cloudflare Access on https://crm.unikrn.com . BUt this link bypassed Cloudflare Access: ████████/login This vulnerability generates the disclosure of important data: PHP info page: ██████████phpinfo ...