CVE-2026-106460 Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Medium 6.8 Published 6 Oct 2026 Updated 9 Oct 2026

Attackers can bypass email verification checks to assume other catalog identities and gain unauthorized access in Backstage developer portals.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-106460?

CVE-2026-106460 is a medium-severity authentication bypass vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.

Weakness: CWE-287

Which versions are affected by CVE-2026-106460?

4 open source packages ship an affected version, including @backstage/plugin-auth-node. It affects 2 products.

Package	Affected	Fixed in
`@backstage/plugin-auth-node` npm	From `0.3.0`	`0.6.15`
`@backstage/plugin-auth-node` npm	From `0.3.0`	`0.6.15`
`@backstage/plugin-auth-node` npm	From `0.7.0`	`0.7.5`
`@backstage/plugin-auth-node` npm	From `0.7.0`	`0.7.5`

Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Auth-Node.

How do I fix CVE-2026-106460?

Upgrade @backstage/plugin-auth-node to a fixed version for your release line: 0.6.15 or 0.7.5.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-106460 being exploited?

There is no known exploitation of CVE-2026-106460 in the wild and no public exploit code.

All Linuxfoundation Backstage vulnerabilities

Sources

Also known as GHSA-xm5q-p7w3-x6cp.