Backstage is an open developer portal framework. The Cloudflare Access authentication module verifies a token's signature and issuer but does not ensure that the token's audience claim matches the Backstage application. If an attacker possesses a valid token issued for a different Access application within the same Cloudflare Zero Trust team, that token can reach Backstage's authentication endpoint and allow the attacker to authenticate. This bypasses normal access control and may grant the attacker access to all resources available to authenticated Backstage users.

Affected releases are the Backstage framework and the @backstage/plugin-auth-backend-module-cloudflare-access-provider package from version 0.1.0 through 0.5.0. The issue was addressed in version 0.5.0, so any installation using a version in that range without the patch is vulnerable.

The CVSS score of 6.8 indicates medium severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, but the vulnerability is publicly disclosed and no evidence of active exploitation is currently reported (not listed in KEV). The attack likely requires an attacker to obtain or share a valid token for another application; once the token reaches the Backstage auth endpoint, the flaw can be exploited without additional privileges. Because the flaw is in authentication logic, compromise results in unauthorized access to the Backstage portal and any services it exposes to logged‑in users.