Cve-2026-106488 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-106488/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 07 Oct 2026 22:55:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Authentication Vulnerability in Backstage OIDC Providerhttps://feed.craftedsignal.io/briefs/2026-10-backstage-oidc-auth/Wed, 07 Oct 2026 22:55:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-backstage-oidc-auth/A vulnerability in the Backstage OIDC authentication module allows authenticated users to spoof identities when using email-based resolution with unverified email providers, leading to unauthorized access.Backstage's @backstage/plugin-auth-backend-module-oidc-provider is affected by an improper authentication vulnerability, tracked as CVE-2026-106488. The flaw exists in the email-based identity resolution process when configured with OIDC providers that do not enforce email verification. An attacker who is authenticated via a malicious or misconfigured OIDC provider can supply an unverified email address that matches an existing user in the Backstage catalog. The application incorrectly maps the attacker's session to the identity of the victim user, allowing for full impersonation of that user's identity and associated permissions within the Backstage environment. This vulnerability affects versions prior to 0.4.20. Defenders should note that this vulnerability does not represent a code injection or direct system compromise, but rather a logic flaw in how identity claims are validated during the OIDC handshake.

Impact

Successful exploitation allows for unauthorized access to catalog entities and sensitive resources managed by Backstage by assuming the identity of another user. This can lead to privilege escalation if the spoofed user account holds administrative roles or high-level access to internal developer portal documentation, service metadata, or infrastructure configurations. No specific victim counts have been reported, but organizations utilizing email-based OIDC identity resolution are at risk if their provider allows unverified addresses.

Recommendation

  • Upgrade the @backstage/plugin-auth-backend-module-oidc-provider package to version 0.4.20 or later to include the patch for CVE-2026-106488.
  • Review OIDC provider configurations and disable email-based identity resolution if email verification cannot be strictly enforced at the provider level.
  • Monitor authentication logs for unexpected account mappings or user sessions originating from non-standard or untrusted OIDC provider issuers.
]]>highadvisoryauthentication-bypasscve-2026-106488backstage