{"action":"Upgrade @backstage/plugin-auth-node to 0.6.15 or later.","affected":[{"fixed":"0.6.15","introduced":"0.3.0"},{"fixed":"0.7.5","introduced":"0.7.0"}],"component":"@backstage/plugin-auth-node","cve_ids":["CVE-2026-106460"],"ecosystem":"npm","epss":0.00314,"exploited":false,"fixed_versions":["0.6.15","0.7.5"],"ghsa_id":"GHSA-xm5q-p7w3-x6cp","id":"tcs_01M5KGJAM6MJWG435HF5DX7EES","modified_at":"2026-10-07T20:30:06.837006795Z","published_at":"2026-10-07T20:23:52Z","references":["https://osv.dev/vulnerability/GHSA-xm5q-p7w3-x6cp","https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp","https://nvd.nist.gov/vuln/detail/CVE-2026-106460","https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb","https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38","https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.49.7","https://github.com/backstage/backstage/releases/tag/v1.54.7"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-xm5q-p7w3-x6cp","url":"https://osv.dev/vulnerability/GHSA-xm5q-p7w3-x6cp"}],"summary":"Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization"}