Plugin auth node: Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization (CVE-2026-106460)

The vulnerability in @backstage/plugin-auth-node involves improper handling of email verification metadata during shared OAuth profile normalization. Affected versions may pass an email address marked as unverified (email_verified: false) to email-based sign-in resolvers, or fail to respect this flag in ID-token-only fallback scenarios. Exploitation requires a deployment where a user can supply or change an unverified email and Backstage uses that email to resolve catalog identities, potentially allowing identity impersonation and unauthorized access. The issue does not affect cases where the email_verified claim is absent but relies on authoritative provisioning. The vulnerability is fixed in versions 0.6.15 and 0.7.5, with patches included in Backstage v1.49.7 and v1.54.7.

An attacker with the ability to supply or modify an unverified email address in a vulnerable Backstage deployment could impersonate another catalog identity, gaining its associated access and permissions. This could lead to unauthorized access to resources or actions within the Backstage environment. The vulnerability does not affect deployments that restrict sign-in to verified emails or use resolvers that do not depend on profile emails.

A fix is available in @backstage/plugin-auth-node versions 0.6.15 and 0.7.5. Users should upgrade to these versions or later. Additional mitigations include requiring identity providers to verify user-controlled email addresses before sign-in, ensuring profile emails are immutable and provisioned from trusted sources, using sign-in resolvers that do not rely on profile emails, or implementing custom profile transforms that omit emails marked as unverified.