CVE-2026-32235: @backstage/plugin-auth-backend OAuth Redirect URI Allowlist Bypass Vulnerability
Summary
CVE-2026-32235: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass. Affects @backstage/plugin-auth-backend versions < 0.27.1. Fixed in 0.27.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-auth-backend package is a component of the Backstage platform, which is designed to facilitate the development of developer portals. This plugin provides authentication capabilities, including support for OpenID Connect (OIDC). The package includes experimental features such as Dynamic Client Registration and Client ID Metadata Documents, which allow for more flexible OAuth configurations. However, these experimental features introduce potential security risks, particularly related to redirect URI validation.
Vulnerability Detail
The vulnerability arises from a flaw in the experimental OIDC provider within the @backstage/plugin-auth-backend package. Specifically, it allows for a redirect URI allowlist bypass. When experimental features like Dynamic Client Registration or Client ID Metadata Documents are enabled, a specially crafted redirect URI can bypass the configured allowlist. This means that an attacker can manipulate the redirect URI to point to a malicious host. If a victim interacts with the OAuth consent request and approves it, their authorization code is sent to the attacker, who can then exchange it for a valid access token. This vulnerability requires user interaction and is not enabled by default, but it poses a significant risk if the experimental features are in use.
How To Fix
Latest published version: 0.30.2 as of 22 Oct 2026
npm install @backstage/plugin-auth-backend@0.30.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.27.1
This is the first release that contains the fix.
npm install @backstage/plugin-auth-backend@0.27.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you do not require the experimental features, consider disabling Dynamic Client Registration and Client ID Metadata Documents to mitigate the risk associated with this vulnerability. This can typically be done in your configuration settings for the plugin.
Conclusion
The @backstage/plugin-auth-backend package has a vulnerability that allows for a redirect URI allowlist bypass, posing a risk to applications using its experimental features. Upgrading to version 0.27.1 or later is crucial for mitigating this risk. Additionally, disabling experimental features can serve as a temporary workaround. Regular monitoring for vulnerabilities using tools like Vulert is recommended.
See every vulnerability recorded for @backstage/plugin-auth-backend →
FAQ
The vulnerability allows for a redirect URI allowlist bypass, enabling attackers to redirect authorization codes to malicious hosts.
If exploited, an attacker could obtain valid access tokens by tricking users into approving OAuth requests.
If you are using the @backstage/plugin-auth-backend package with experimental features enabled, your application may be at risk.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-auth-backend.
