The Salesforce module before 1

CVE-2026-45430 is an OAuth authorization-flow CSRF in the Backdrop CMS Salesforce module: versions earlier than 1.x-1.0.1 do not generate and validate a cryptographically random state value, and the vendor notes the OAuth callback may be reachable by most authenticated users and sometimes anonymous users depending on site configuration. In practice, that means an attacker can try to confuse or bind the authorization callback to the wrong OAuth transaction during Salesforce setup, potentially causing the site to accept attacker-influenced authorization results.

The CNA/NVD-style 7.1 HIGH score is technically defensible in a lab because the bug can affect confidentiality and integrity over the network. In enterprise reality, that overstates the operational risk: the module is niche, the victim population is only Backdrop sites that installed this specific contrib module, exploitation usually depends on catching a privileged user during a Salesforce authorization workflow, and there is no evidence here of mass scanning, KEV inclusion, or public weaponization.

Why this verdict

• Started from 7.1 HIGH: the CNA vector assumes meaningful confidentiality and integrity impact over a network path, and that's fair in a vacuum.
• Downgraded for attacker position reality: this is not unauthenticated one-shot server compromise; it generally requires a victim user in the browser and, in practice, usually a user with configuration authority over the Salesforce integration.
• Downgraded for exposure population: Backdrop is already a smaller ecosystem, and this is a specific contributed module inside it. That is a compounding population reducer versus mass-target products.
• Downgraded for exploitation evidence: no KEV listing, no reviewed public exploitation reports, and an extremely low EPSS score argue against near-term opportunistic abuse.
• Stopped at MEDIUM, not LOW: if the attack lands, the impact can be real for mapped CRM data and token binding, especially where the callback is broadly reachable and the integration syncs sensitive objects.

Why not higher?

This is not the kind of bug that turns into internet-wide spray-and-pray compromise. The chain depends on a narrow product population, a vulnerable OAuth workflow, and user interaction at the right moment; those are strong, compounding brakes on operational risk.

Why not lower?

The bug is not harmless hardening. Missing state protection in OAuth is a well-understood security control failure, and the vendor explicitly notes broad callback reachability, so successful abuse can still alter or expose Salesforce-linked data in a meaningful way.

1. Restrict the callback path — Limit access to /salesforce/oauth_callback with reverse-proxy rules, allowlists, or at minimum authenticated-session checks where your architecture permits. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control is worth deploying in the next normal change cycle because it cuts the anonymous attack surface immediately.
2. Gate Salesforce authorization to admins only — Review Backdrop permissions and any route access controls so only tightly scoped administrators can initiate or complete Salesforce authorization. There is no mitigation SLA for MEDIUM here, but this is a fast permission hardening measure you should complete before the remediation deadline.
3. Monitor OAuth callback and token events — Alert on unusual hits to the Salesforce callback, repeated authorization attempts, or Salesforce tenant changes outside approved maintenance windows. This does not fix the root cause, but it gives you a chance to catch misuse while you work through the 365-day patch window.
4. Review mapped objects and secrets exposure — Identify what entities, fields, and sync jobs the module can touch so you know the true blast radius if an authorization mix-up occurred. For MEDIUM there is no mitigation SLA, but scoping the data path now helps validate whether any temporary restrictions are justified before patching.

Run this on the target Backdrop host or against a mounted webroot, not from an auditor workstation. Invoke it as bash check_cve_2026_45430.sh /var/www/backdrop with read access to the code tree; root is not required unless your webroot permissions are locked down.

#!/usr/bin/env bash
# check_cve_2026_45430.sh
# Detects whether the Backdrop CMS Salesforce module is below 1.x-1.0.1.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"
FIXED="1.0.1"

if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/backdrop-root"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - target path does not exist: $TARGET"
  exit 2
fi

candidates=(
  "$TARGET/modules/salesforce/salesforce.info"
  "$TARGET/modules/contrib/salesforce/salesforce.info"
  "$TARGET/sites/all/modules/salesforce/salesforce.info"
  "$TARGET/sites/all/modules/contrib/salesforce/salesforce.info"
  "$TARGET/salesforce/salesforce.info"
)

INFO_FILE=""
for f in "${candidates[@]}"; do
  if [[ -f "$f" ]]; then
    INFO_FILE="$f"
    break
  fi
done

if [[ -z "$INFO_FILE" ]]; then
  INFO_FILE=$(find "$TARGET" -type f -path '*/salesforce/salesforce.info' 2>/dev/null | head -n 1)
fi

if [[ -z "$INFO_FILE" ]]; then
  echo "UNKNOWN - could not locate salesforce.info under $TARGET"
  exit 2
fi

version_line=$(grep -E '^version\s*=\s*"?.+"?$' "$INFO_FILE" 2>/dev/null | head -n 1 || true)
if [[ -z "$version_line" ]]; then
  echo "UNKNOWN - version line not found in $INFO_FILE"
  exit 2
fi

raw_version=$(echo "$version_line" | sed -E 's/^version\s*=\s*"?([^\"]+)"?$/\1/')
# Expected examples: 1.x-1.0.0 , 1.x-1.0.1 , 1.x-1.0.2
release_part=$(echo "$raw_version" | sed -E 's/^.*-([0-9]+\.[0-9]+\.[0-9]+)$/\1/')

if [[ ! "$release_part" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "UNKNOWN - unrecognized version format '$raw_version' in $INFO_FILE"
  exit 2
fi

lowest=$(printf '%s\n%s\n' "$release_part" "$FIXED" | sort -V | head -n 1)

if [[ "$release_part" == "$FIXED" ]]; then
  echo "PATCHED - found Salesforce module version $raw_version in $INFO_FILE"
  exit 0
fi

if [[ "$lowest" == "$release_part" && "$release_part" != "$FIXED" ]]; then
  echo "VULNERABLE - found Salesforce module version $raw_version in $INFO_FILE (fixed: 1.x-1.0.1)"
  exit 1
fi

echo "PATCHED - found Salesforce module version $raw_version in $INFO_FILE"
exit 0

Sources

1. Backdrop advisory for CVE-2026-45430
2. Backdrop security advisories index
3. Backdrop Salesforce project page
4. GitHub release 1.x-1.0.1
5. Backdrop security advisory policy
6. FIRST EPSS API documentation
7. CISA Known Exploited Vulnerabilities Catalog
8. CVE record landing page