CVE-2026-106460
1 advisory.
npm/@backstage/plugin-auth-node CVE-2026-106460: medium 6.8
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Action: Upgrade @backstage/plugin-auth-node to 0.6.15 or later.
npm i @backstage/plugin-auth-node@0.6.15npm i @backstage/plugin-auth-node@0.7.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.3.0 | 0.6.15 | - |
| 0.7.0 | 0.7.5 | - |
Fixed versions
| 0.6.15 | 0.7.5 |
Sources
- osv: GHSA-xm5q-p7w3-x6cp
- https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp
- https://nvd.nist.gov/vuln/detail/CVE-2026-106460
- https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb
- https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38
- https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d
- https://github.com/backstage/backstage
- https://github.com/backstage/backstage/releases/tag/v1.49.7
- https://github.com/backstage/backstage/releases/tag/v1.54.7
CVE-2026-106460 · published · modified · JSON