CVE-2026-106460

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

CVE-2026-106460

The @backstage/plugin-auth-node package in the Backstage framework (versions 0.3.0 through 0.6.15 and 0.7.5) fails to consistently honor explicit negative email verification during shared OAuth profile normalization. Specifically, it may ignore verified: false or email_verified: false claims in c...

Cookie modification allows unauthenticated user login in Geeklog 1.3

A major security vulnerability exists in Geeklog 1.3, released on December 30th, 2001. When permanent cookies are enabled, as they are in a stock install, Geeklog stores a user's UID in a cookie upon successful login. This cookie is subsequently used during future visits to the site to...