CVE-2026-32235: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
Impact
The experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected.
A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.
This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.
Patches
Upgrade to @backstage/plugin-auth-backend version 0.27.1 or later.
Workarounds
Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.
References
- RFC 6749 Section 3.1.2 - Redirection Endpoint
Other sources
Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32235?
CVE-2026-32235 is considered a critical vulnerability due to its potential for redirect URI allowlist bypass.
How do I fix CVE-2026-32235?
To fix CVE-2026-32235, upgrade to a version of @backstage/plugin-auth-backend that is above 0.27.1.
Which versions of @backstage/plugin-auth-backend are affected by CVE-2026-32235?
CVE-2026-32235 affects versions of @backstage/plugin-auth-backend up to and including 0.27.1.
What features make systems vulnerable to CVE-2026-32235?
Enabling experimental Dynamic Client Registration or Client ID Metadata Documents with misconfigured allowedRedirectUriPatterns can expose systems to CVE-2026-32235.
Can the vulnerability CVE-2026-32235 be exploited remotely?
Yes, CVE-2026-32235 can be exploited remotely if affected configurations are in place.