Improper Authentication in Backstage's OIDC Provider Affects User Identity Management

CVE-2026-106488

What is CVE-2026-106488?

The Backstage OIDC Provider, prior to version 0.4.20, is susceptible to improper authentication, specifically in its handling of email-based identity resolution. When configured to allow unverified email addresses, it may enable a provider user with authentication to gain access to the catalog identities of other users. This flaw raises concerns regarding the unauthorized access to sensitive information and permissions associated with these identities. Fortunately, this issue has been addressed in version 0.4.20, so users are advised to upgrade to this version or later to mitigate any risks.

References