CVE-2026-106488

Executive Summary

CVE-2026-106488 is an improper authentication vulnerability (CWE-287) affecting the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to version 0.4.20. Deployments that rely on OIDC email-based identity resolution combined with an identity provider that allows unverified email addresses may permit an authenticated provider user to assume another catalog identity, inheriting that user's access and permissions. The flaw carries a CVSS v3.1 base score of 8.1 (High), reflecting high confidentiality and integrity impact, and currently has no public proof-of-concept, no known exploitation in the wild, and no CISA KEV listing.

Technical Analysis

Backstage is an open framework for building developer portals. The affected component, @backstage/plugin-auth-backend-module-oidc-provider, handles authentication via OpenID Connect (OIDC) providers. The vulnerability resides in the identity resolution logic: when the plugin maps an OIDC-authenticated principal to a Backstage catalog identity, it can resolve that identity based on the email address asserted by the OIDC provider.

The core defect is a failure to enforce that the email address used for identity resolution is verified. Where the OIDC provider permits an unverified email address to be supplied (or where verification status is not validated before resolution), an attacker who holds any valid authenticated account at that provider can present an email address belonging to another user and be matched to that user's catalog identity. This is an improper authentication flaw — the system grants a session/identity to a principal that has not proven ownership of the identity being assumed.

Because the mapping is email-based, the attack does not require breaking cryptography or exploiting memory corruption. It abuses a trust assumption: that the email claim emitted by the OIDC provider is trustworthy and verified. When that assumption fails (unverified emails allowed), the authentication boundary is effectively bypassed for any target whose email an attacker can assert. The issue is fixed in version 0.4.20.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates network attack, low complexity, low privileges required (any authenticated provider user), no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. The absence of any patch evidence from tracked sources, despite the version reference, warrants verification against the upstream advisory before assuming remediation status.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred from the vulnerability class (improper authentication via unverified email identity resolution) as described in the NVD entry.

1. Reconnaissance / target identification: The attacker identifies a Backstage deployment that uses the OIDC provider plugin with email-based identity resolution. This is observable through standard login flows that redirect to an OIDC identity provider and through portal behavior that keys accounts to email addresses. The attacker needs only a valid account at the same OIDC provider.

2. Triggering the flaw: The attacker authenticates normally to the OIDC provider. During the OIDC flow, the provider asserts an email address. If the provider permits an unverified email address — or the plugin does not confirm the verified status of that email — the plugin resolves the Backstage catalog identity by matching that asserted email. This maps the attacker to the victim's identity.

3. Execution at the vulnerability-class level: The attacker supplies (or manipulates) the email claim to equal the target user's email within the provider. No code injection or payload delivery is required; the "payload" is the asserted identity claim itself. The plugin accepts it because verification is not enforced, resulting in an improper authentication outcome.

4. Post-exploitation impact: The attacker inherits the victim's Backstage catalog identity and any permissions and access associated with it, enabling access to internal developer portal resources, service catalog entries, and privileged actions available to that identity. High confidentiality and integrity impact follow; no availability impact is demonstrated.

Impact Assessment

Successful exploitation allows an authenticated provider user to impersonate another catalog identity, granting the attacker that user's access and permissions (C:H/I:H). In a developer portal, impersonated identities frequently hold elevated entitlements — access to repositories, CI/CD pipelines, cloud credentials references, and environment metadata — making lateral movement and privilege escalation plausible. The blast radius depends on how many users rely on the affected OIDC login path and the privileges those identities hold. With CVSS AV:N/AC:L/PR:L/UI:N, exploitation is remotely reachable, low complexity, requires only a low-privileged authenticated account, and needs no victim interaction, raising the likelihood of success in affected deployments. Scope is unchanged (S:U) and there is no demonstrated availability impact (A:N). EPSS is not yet scored by FIRST.org; there is no evidence of active exploitation or CISA KEV inclusion at this time.

Detection Guidance

Sigma Rule

title: Backstage OIDC Email-Based Identity Resolution Abuse (CVE-2026-106488)
id: 6f1a9c2e-4b7d-4a1e-9c3f-2d8e5b0a7f41
status: experimental
description: Detects suspicious OIDC login activity where an authenticated provider user may resolve to a different Backstage catalog identity via unverified email claims.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106488
author: valtersit.com
logsource:
  product: backstage
  service: auth-backend
detection:
  selection_pkg:
    package|contains: 'plugin-auth-backend-module-oidc-provider'
  selection_event:
    event|contains:
      - 'oidc'
      - 'identity resolution'
      - 'email'
  selection_anomaly:
    email_verified: false
    result: success
  condition: selection_pkg and selection_event and selection_anomaly
falsepositives:
  - Legitimate providers that do not emit email_verified claims
level: high
tags:
  - attack.t1078
  - cve.2026.106488

YARA Rule

rule CVE_2026_106488_Backstage_OIDC_Improper_Auth
{
    meta:
        description = "Detects references to affected Backstage OIDC provider package version string"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106488"
        date = "2026-01-01"
    strings:
        $pkg = "plugin-auth-backend-module-oidc-provider" ascii
        $ver1 = "0.4.19" ascii
        $ver2 = "0.4.18" ascii
        $oidc = "oidc" ascii nocase
        $email = "email" ascii nocase
    condition:
        $pkg and $oidc and ($ver1 or $ver2) and $email
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106488 Backstage OIDC Identity Resolution Abuse Attempt"; flow:established,to_server; http.uri; content:"/api/auth"; nocase; content:"oidc"; nocase; content:"email"; nocase; classtype:attempted-user; sid:2026106488; rev:1;)

Elastic Detection

sequence by user.email with maxspan=5m
  [authentication where event.action == "user_login" and oidc.provider != null]
  [authentication where event.action == "user_login" and email.verified == false and event.outcome == "success"]

Splunk SPL Query

index=backstage sourcetype=backstage:auth
  ("plugin-auth-backend-module-oidc-provider" OR "oidc")
  (email_verified=false OR "unverified")
  "identity resolution"
| stats count by user, src_ip, dest, email, _time
| where count > 0
| sort - _time

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106488,">
  <rule id="106488" level="12">
    <decoded_as>json</decoded_as>
    <field name="package">plugin-auth-backend-module-oidc-provider</field>
    <field name="email_verified">false</field>
    <description>CVE-2026-106488: Backstage OIDC email-based identity resolution abuse detected</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict or disable OIDC login paths that rely on email-based identity resolution.
• Enforce that the OIDC provider emits and that Backstage requires a verified email claim before identity resolution.
• Reduce the privileges of catalog identities reachable via OIDC to limit the impact of assumed identities.

2. Patch/upgrade steps:

• Upgrade @backstage/plugin-auth-backend-module-oidc-provider to version 0.4.20, where the issue is reported fixed.
• Because no patch evidence was found from tracked sources, validate the fix against the upstream Backstage repository and release notes before relying on version 0.4.20 as remediated.
• Inventory all Backstage deployments and confirm which OIDC providers are configured and whether email-based resolution is enabled.

3. Long-term hardening:

• Adopt providers that guarantee verified email addresses and reject unverified-email flows.
• Implement identity-resolution logic bound to a stable, provider-verified subject identifier rather than email.
• Add monitoring and alerting for identity-resolution events where verification status is absent or false (see Detection Guidance).

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106488
• Backstage project (open framework for developer portals): https://backstage.io
• Backstage repository and security advisories: https://github.com/backstage/backstage/security/advisories
• MITRE CWE-287 (Improper Authentication): https://cwe.mitre.org/data/definitions/287.html
• CISA Known Exploited Vulnerabilities catalog (no entry for this CVE at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog