CVE-2026-106488
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The @backstage/plugin-auth-backend-module-oidc-provider package before version 0.4.20 has improper authentication in the OIDC provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity.
Risk Assessment
An attacker could gain access and permissions associated with another user, potentially leading to unauthorized access to resources. No direct availability impact is demonstrated.
Recommendation
Update @backstage/plugin-auth-backend-module-oidc-provider to version 0.4.20 or later. Ensure the OIDC provider requires verified email addresses.
Related vulnerabilities
- CVE-2026-53921Critical
In odhcpd (the DHCPv6/DHCPv4/RA server used by OpenWrt) prior to version 25.12, the DHCPv6 IA response handler writes past a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable over the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt, and embedded targets often lack stack canaries and ASLR, making code execution realistic.
- CVE-2026-114357Critical
In DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9, the Android Debug Bridge daemon (adbd) lacks authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default; once ADB over TCP is enabled, the same unauthenticated shell (uid 2000) is reachable over the network. This provides a foothold for privilege escalation to root.
- CVE-2026-57116Critical
In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.
- CVE-2026-112859Critical
The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.
- CVE-2026-112858Critical
The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.
- CVE-2026-112857Critical
The Reprizo WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Reprizo from n/a through 1.0.8.
- CVE-2026-112856Critical
The Vagabonds WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Vagabonds from n/a through 1.3.10.
- CVE-2026-112855Critical
The Redy WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Redy from n/a through 1.3.5.
- CVE-2026-112854Critical
The Holistic Center WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Holistic Center from n/a through 1.2.6.
- CVE-2026-112853Critical
The Hallelujah WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Hallelujah from n/a through 1.1.1.
Original NVD description (English source)
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS