The flaw exists when Backstage’s authentication plugin fails to honor explicit negative email verification during shared OAuth profile normalization. This misstep allows a user who can supply or modify an unverified email address to be treated as if the email were verified. As a result, the system can resolve an alternate catalog identity tied to that unverified email, giving the attacker the permissions associated with that identity. The weakness is a classic instance of improper authentication (CWE‑287) and improper access control (CWE‑290) that can move from a single user to the entire system if the impersonated identity has elevated privileges.

Affected products are the @backstage/plugin-auth-node package and the backstage framework itself. Versions from 0.3.0 up through the release immediately preceding 0.6.15 and 0.7.5 are vulnerable. The patch was introduced in plugin‑auth-node 0.6.15 and 0.7.5, and subsequent releases—including backstage 1.49.7 and 1.54.7—contain the fix. The issue impacts deployments that rely on shared OAuth profile normalization, particularly where the selected profile email is used to resolve catalog identities.

The CVSS score of 6.8 indicates medium‑to‑high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated identity‑provider user who can add or change an unverified email claim, along with a deployment that uses the selected profile email for catalog identity lookup. The likely attack vector involves compromising or manipulating the upstream identity provider or obtaining user credentials. Once the conditions are met, the attacker can elevate privileges by impersonating another catalog identity, potentially affording domain‑wide compromise.