Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The ID-token-only fallback likewise did not consistently respect email_verified: false. Exploitation requires a deployment where an admitted identity-provider user can supply or change an email address without verification and Backstage uses that profile email to resolve catalog …