CVE-2026-106488: @backstage/plugin-auth-backend-module-oidc-provider Improper Authentication Vulnerability
Summary
CVE-2026-106488: Backstage: Improper authentication in the OIDC provider. Affects @backstage/plugin-auth-backend-module-oidc-provider versions < 0.4.20. Fixed in 0.4.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-auth-backend-module-oidc-provider is a plugin for the Backstage platform that facilitates authentication through OpenID Connect (OIDC). This module allows users to authenticate using various identity providers, streamlining access to services and resources. However, it is vulnerable to improper authentication when email-based identity resolution is used with providers that do not verify email addresses, potentially allowing unauthorized access to user accounts.
Vulnerability Detail
The vulnerability arises from the use of email-based identity resolution in OIDC deployments that permit unverified email addresses. An authenticated user from the identity provider could exploit this flaw to assume another user's catalog identity, thereby gaining access to sensitive information and permissions associated with that user. This vulnerability does not directly impact the availability of the service but poses a significant security risk due to the potential for unauthorized access.
How To Fix
Latest published version: 0.4.22 as of 22 Oct 2026
npm install @backstage/plugin-auth-backend-module-oidc-provider@0.4.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.20
This is the first release that contains the fix.
npm install @backstage/plugin-auth-backend-module-oidc-provider@0.4.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable email-based sign-in resolution for the OIDC provider or require the identity provider to verify email addresses before allowing sign-in. This can help mitigate the risk until the package is updated.
Conclusion
The improper authentication vulnerability in the @backstage/plugin-auth-backend-module-oidc-provider poses a significant security risk by allowing unauthorized access to user accounts. It is crucial to update the package to the patched version or implement workarounds to mitigate the risk until the update can be applied.
See every vulnerability recorded for @backstage/plugin-auth-backend-module-oidc-provider →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
The vulnerability could allow an authenticated user to assume another user's identity, granting them unauthorized access to sensitive information and permissions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, a patch is available in version 0.4.20 of the @backstage/plugin-auth-backend-module-oidc-provider package.
If you cannot update the package immediately, consider disabling email-based sign-in resolution or requiring email verification from the identity provider as a temporary workaround.
