Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M

CVE-2026-32235@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

Medium 5.9

In plain English

A medium-severity open redirect in plugin-auth-backend from @backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.1%top 96.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@backstage/plugin-auth-backend	0.27.1	GHSA-wqvh-63mv-9w92

Affected products (as reported)

Vendor	Product	Versions
@backstage	plugin-auth-backend	< 0.27.1

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92 x_refsource_CONFIRM