CVE-2026-106457

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106457

The Backstage developer portal framework is vulnerable due to insufficient audience validation in the @backstage/plugin-auth-backend-module-cloudflare-access-provider package. Affected versions range from 0.1.0 until 0.5.0 . While the provider verifies the token's signature and team issuer, it fa...

CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...