CVE-2026-106488
Last modified
CVE-2026-106488 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| backstage | backstage | < 1.54.6 |
| @backstage | plugin-auth-backend-module-oidc-provider | < 0.4.20 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-106488?
How severe is CVE-2026-106488?
How do I fix CVE-2026-106488?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-106463Backstage is an open framework for building developer portal…5.4
- CVE-2026-10647The USB CDC-NCM device class (subsys/usb/device_next/class/u…5.3
- CVE-2026-106471A flaw was found in Candlepin. The central authorization fil…8.1
- CVE-2026-10648mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport…5.5
- CVE-2026-106486Backstage is an open framework for building developer portal…8.5
- CVE-2026-106487Backstage is an open framework for building developer portal…3.5
- CVE-2026-106489Backstage is an open framework for building developer portal…6.5
- CVE-2026-10649A flaw was found in Pacemaker. An unauthenticated remote att…8.6
- CVE-2026-106490Backstage is an open framework for building developer portal…6.5
- CVE-2026-106491Backstage is an open framework for building developer portal…6.4
- CVE-2026-106492Backstage is an open framework for building developer portal…7.6
- CVE-2026-106493Backstage is an open framework for building developer portal…3
Are you affected by CVE-2026-106488?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST