CVE-2026-106460

The @backstage/plugin-auth-node package in the Backstage framework (versions 0.3.0 through 0.6.15 and 0.7.5) fails to consistently honor explicit negative email verification during shared OAuth profile normalization. Specifically, it may ignore verified: false or email_verified: false claims in c...