@backstage plugin-auth-backend

• CVE-2026-32236 Low 1.7 @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch 0.3%
• CVE-2026-32235 Medium 5.9 @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass 0.1%