Disclosure summary
### Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. ### Patches Patched in `@backstage/plugin-auth-backend-module-oidc-provider` version `0.4.20`. ### Workarounds - Disable email-based sign-in resolution for the OIDC provider, or require the identity provider to verify email addresses before allowing sign-in.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-826h-28h9-65hg
Open original source · Updated Oct 07, 2026
Backstage: Improper authentication in the OIDC provider
Source severity: HIGH / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | @backstage/plugin-auth-backend-module-oidc-provider | < 0.4.20 | 0.4.20 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-07T14:01:02-04:00
MODIFIED 2026-10-07T14:01:03-04:00
INGESTED 2026-10-08T12:30:38-04:00