{"id":"CVE-2026-32235","aliases":["EUVD-2026-11671","GHSA-wqvh-63mv-9w92","ROOT-APP-NPM-CVE-2026-32235"],"status":"published","title":"@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass","description":"Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00167,"percentile":0.06038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-601"],"published":"2026-03-12T14:50:59Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"npm","package":"@backstage/plugin-auth-backend","fixed_in":["0.27.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/backstage__plugin-auth-backend","fixed_in":["0.25.7-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@backstage/plugin-auth-backend","fixed_in":["0.25.7-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@backstage/plugin-auth-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@backstage/plugin-auth-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/backstage__plugin-auth-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.7-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@backstage/plugin-auth-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.7-aikido.2"}]}]}],"products":[{"vendor":"@backstage","product":"plugin-auth-backend"},{"vendor":"linuxfoundation","product":"backstage"}],"references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32235","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wqvh-63mv-9w92"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32235.json","tags":["advisory"]},{"url":"https://github.com/backstage/backstage","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-32235","title":"@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass","description":"Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.","status":"published","published":"2026-03-12T18:35:06.325Z","modified":"2026-03-12T20:46:46.618Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-11671","description":"Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.","status":"published","published":"2026-03-12T18:35:06Z","modified":"2026-03-12T20:46:46Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:35.389351Z"}],"ghsa":[{"id":"GHSA-wqvh-63mv-9w92","title":"@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass","description":"### Impact\n\nThe experimental OIDC provider in `@backstage/plugin-auth-backend` is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured `allowedRedirectUriPatterns` are affected.\n\nA specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.\n\nThis requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.\n\n### Patches\n\nUpgrade to `@backstage/plugin-auth-backend` version 0.27.1 or later.\n\n### Workarounds\n\nDisable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.\n\n### References\n\n- [RFC 6749 Section 3.1.2 - Redirection Endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2)","status":"published","published":"2026-03-12T14:50:59Z","modified":"2026-03-13T13:35:46Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-601"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2026-32235","description":"Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.","status":"published","published":"2026-03-12T19:16:17.443Z","modified":"2026-06-17T10:35:23.907Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-32235","title":"@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass","description":"Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.","status":"published","published":"2026-03-12T18:35:06.325Z","modified":"2026-10-28T02:30:44.949681745Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"GHSA-wqvh-63mv-9w92","title":"@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass","description":"### Impact\n\nThe experimental OIDC provider in `@backstage/plugin-auth-backend` is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured `allowedRedirectUriPatterns` are affected.\n\nA specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.\n\nThis requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.\n\n### Patches\n\nUpgrade to `@backstage/plugin-auth-backend` version 0.27.1 or later.\n\n### Workarounds\n\nDisable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.\n\n### References\n\n- [RFC 6749 Section 3.1.2 - Redirection Endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2)","status":"published","published":"2026-03-12T14:50:59Z","modified":"2026-03-14T01:56:21.282129Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-601"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"ROOT-APP-NPM-CVE-2026-32235","title":"CVE-2026-32235 in @rootio/backstage__plugin-auth-backend - Patched by Root","description":"Root has patched CVE-2026-32235 in the @rootio/backstage__plugin-auth-backend package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-25T10:36:22Z","modified":"2026-06-25T13:17:39.284304859Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}