The vulnerability is an authentication flaw in Backstage’s OIDC provider module, where email‑based identity resolution does not verify email addresses. An attacker who authenticates to the OIDC provider can trick the system into treating the attacker as a different catalog identity, allowing the attacker to access the permissions and resources associated with that identity. The weakness is a classic impersonation attack (CWE-287) as well as an authorization bypass due to unverified email verification (CWE-290). No direct impact on availability is documented.

Affected components are @backstage/plugin‑auth‑backend‑module‑oidc‑provider and the Backstage platform itself. The flaw exists in all releases prior to version 0.4.20 of the plugin and has been fixed in that release. Upgrade to 0.4.20 or later, and align the Backstage core to the corresponding patched release, is required to remove the vulnerability.

The CVSS score of 8.1 indicates a high severity due to potential privilege escalation. The EPSS score of 0.0028 indicates a very low probability of exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector requires an authenticated user of a provider that allows unverified email addresses; once authenticated, the attacker can assume another user’s identity. This exploit is consistent with CWE-287 (improper authentication) and CWE-290 (improper authorization). In the absence of an active exploit, the risk remains primarily theoretical but still significant because it permits unauthorized access to a user’s permissions.