CVE-2026-106460

Executive Summary

CVE-2026-106460 is an improper authentication vulnerability (CWE-287) in the @backstage/plugin-auth-node package, an npm library used by Backstage developer portals to normalize OAuth profiles from external identity providers. In affected versions (0.3.0 through 0.6.14, and 0.7.0 through 0.7.4), the plugin failed to consistently honor explicit negative email verification (verified: false / email_verified: false) when resolving catalog identities from a selected profile email. An admitted identity-provider user who can supply or change an unverified email address may assume another user's catalog identity and inherit that identity's access and permissions. The vulnerability carries a CVSS score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting a high-integrity and high-confidentiality impact achievable only under specific deployment configurations. No public PoC, exploit code, or Nuclei template currently exists.

Technical Analysis

Backstage resolves user identity from OAuth/OIDC provider profiles. The @backstage/plugin-auth-node package performs shared OAuth profile normalization — a code path that maps provider-specific claims into a normalized Backstage identity — and from this normalized profile the deployment selects an email to resolve a catalog identity (the Backstage catalog entity representing a user).

The core defect is that the normalization logic did not consistently honor explicit negative email verification. Per the NVD description, three affected paths exist:

1. A selected profile email marked verified: false — the normalized profile carried an explicit negative verification flag on the email that Backstage then selected for identity resolution.
2. A matching raw provider email marked email_verified: false — the raw provider payload's email carried an explicit negative verification claim that matched the selected email.
3. An email obtained only from an ID token marked email_verified: false — the email was present solely in the OIDC ID token with an explicit negative verification claim.

In all three cases, the verification metadata applied to the selected email. Crucially, the description scopes the flaw: an absent email_verified claim alone is not affected — the vulnerability requires an explicit negative verification assertion. If the deployment uses the selected profile email to resolve catalog identities, the untrusted/unverified email is treated as authoritative, allowing the attacker to claim a catalog identity tied to that email.

The root cause class is an identity-to-catalog binding trust failure: the boundary between "email asserted by provider" and "email cryptographically/administratively verified" collapsed. Business logic trusted the email string while discarding the accompanying negative verification flag.

CVSS reflects this: network vector (AV:N), high attack complexity (AC:H — requires a specific provider configuration and deployment that resolves identities by selected profile email), low privileges (PR:L — attacker must already be an admitted IdP user), no user interaction (UI:N), and high confidentiality/integrity impact (C:H/I:H) with no availability impact (A:N).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only artifacts explicitly named in the description are used.

1) Reconnaissance / target identification. The attacker identifies a Backstage deployment whose IdP integration uses the affected @backstage/plugin-auth-node versions and whose configuration resolves catalog identities from the selected profile email. The attacker must already be an admitted user of the identity provider (an account that has passed IdP authentication).

2) Triggering the flaw class. The attacker supplies or changes an email on their IdP profile such that the selected profile email matches the target victim's catalog identity email, while the verification metadata for that email is explicitly negative — i.e., verified: false on the selected profile email, a matching raw provider email marked email_verified: false, or an email taken only from an ID token marked email_verified: false. Because the plugin does not honor the explicit negative flag, it normalizes the email as if valid.

3) Execution method at the class level. On next authentication/refresh, Backstage resolves the catalog identity using the selected profile email. The plugin's failure to reject the explicitly-unverified email allows the attacker's session to bind to the victim's catalog entity rather than the attacker's own.

4) Post-exploitation impact. The attacker assumes the victim's catalog identity and obtains the access and permissions associated with it — effectively an account/identity takeover within the Backstage portal, potentially exposing catalog data and any downstream resources governed by Backstage authorization. Impact is bounded by the target identity's entitlements.

Note: The attack succeeds only when the deployment uses the selected profile email to resolve catalog identities; deployments resolving identities by another stable identifier are not affected.

Impact Assessment

• Confidentiality (C:H): Attacker gains access to resources entitled to the impersonated catalog identity.
• Integrity (I:H): Actions taken as the victim identity may modify catalog entities, permissions, and downstream state.
• Availability (A:N): No direct availability impact.
• Scope (S:U): Impact confined to the Backstage authorization boundary.
• Blast radius: Limited to deployments that (a) run affected @backstage/plugin-auth-node versions, (b) admit users via an IdP that can supply/change unverified emails with explicit negative verification claims, and (c) resolve catalog identities from the selected profile email. Organizations centralizing identity/authorization through Backstage face privilege escalation and lateral access into connected tooling.

Detection Guidance

Sigma Rule

title: Backstage Unverified Email Catalog Identity Resolution
id: 3f9c1a72-8b4e-4d21-9c77-cve2026106460
status: experimental
description: Detects authentication events where a Backstage catalog identity is resolved from a profile email carrying explicit negative verification metadata (verified false / email_verified false), indicating possible CVE-2026-106460 abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106460
author: valtersit.com
date: 2026/01/01
logsource:
  product: backstage
  service: auth
detection:
  selection_event:
    event.action: 'catalog.identity.resolved'
  selection_verify:
    - email.verified: 'false'
    - email_verified: 'false'
    - profile.email.verified: 'false'
  condition: selection_event and selection_verify
falsepositives:
  - Providers legitimately sending explicit negative verification for non-identity emails
level: high
tags:
  - attack.t1078
  - cwe.287

YARA Rule

rule CVE_2026_106460_Backstage_Unverified_Email
{
    meta:
        description = "Detects references to explicit negative email verification handling in Backstage auth-node source/artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106460"
        date = "2026-01-01"
        cve = "CVE-2026-106460"
    strings:
        $pkg = "@backstage/plugin-auth-node" ascii
        $v1 = "email_verified" ascii
        $v2 = "profile.email.verified" ascii
        $v3 = "verified: false" ascii
    condition:
        $pkg and 2 of ($v*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106460 Backstage unverified email identity resolution attempt"; flow:established,to_server; http.header; content:"backstage"; nocase; content:"auth"; nocase; pcre:"/email_verified[\"']?\s*[:=]\s*(false|0)/i"; reference:cve,CVE-2026-106460; classtype:attempted-user; sid:2026106460; rev:1;)

Elastic Detection

event.category: "authentication" and
event.action: "catalog.identity.resolved" and
(backstage.auth.email.verified: "false" or backstage.auth.email_verified: "false")

Splunk SPL Query

index=backstage sourcetype=backstage:auth action="catalog.identity.resolved"
| search email_verified="false" OR "verified: false" OR profile_email_verified="false"
| stats count BY user, email, selected_profile_email
| where count > 0

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106460,">
  <rule id="106460" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">catalog.identity.resolved</field>
    <field name="email_verified">false</field>
    <description>CVE-2026-106460: Backstage resolved catalog identity from explicitly unverified email</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Do not resolve Backstage catalog identities from the selected profile email; use a stable, non-user-editable identifier (e.g., provider subject identifier) where the deployment supports it.
• Restrict which IdP accounts are admitted and monitor for users changing their profile email.
• Alert on any catalog identity resolution involving verified: false / email_verified: false.

2) Patch/upgrade steps

• Upgrade @backstage/plugin-auth-node to 0.6.15 or 0.7.5, the versions where the issue is fixed.
• Rebuild and redeploy the Backstage backend; verify the dependency resolves to a fixed version.

3) Long-term hardening

• Enforce a policy of trusting only emails with affirmative verification from the provider.
• Centralize identity-to-catalog binding on immutable provider claims.
• Add regression tests for explicit negative verification handling across all OAuth profile normalization paths.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106460
• Backstage project (open framework for developer portals): https://backstage.io
• @backstage/plugin-auth-node package: https://www.npmjs.com/package/@backstage/plugin-auth-node
• CWE-287 Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• No CISA KEV listing, no public PoC, no exploit code, and no known exploit-in-the-wild evidence at time of writing.