backstage plugin-auth-node vulnerabilities

Latest backstage plugin-auth-node CVEs

Newest publication first

1. CVE-2026-106460 Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

   Published 2026-10-06

   Medium·CVSS 6.8 EPSS 0.40%

   Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a select...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.