Executive Summary

CVE-2026-32235 is a vulnerability in the experimental OIDC provider of the @backstage/plugin-auth-backend package prior to version 0.27.1. It involves a bypass of the redirect URI allowlist when certain experimental features—Dynamic Client Registration or Client ID Metadata Documents—are enabled and allowedRedirectUriPatterns are configured.

An attacker can craft a malicious redirect URI that appears valid by passing the allowlist validation but actually redirects to an attacker-controlled host. If a user approves the OAuth consent request triggered by this URI, the attacker receives the victim’s authorization code, which can then be exchanged for a valid access token.

Exploitation requires user interaction and explicit enabling of the experimental features, which are not enabled by default. The vulnerability is fixed in version 0.27.1 of the plugin.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can lead to a high confidentiality loss because an attacker can obtain a victim's OAuth authorization code and exchange it for a valid access token, potentially gaining unauthorized access to protected resources."}, {'type': 'paragraph', 'content': 'The impact includes low integrity loss and no availability impact. However, the attacker gaining access tokens can compromise sensitive data or perform actions on behalf of the victim.'}, {'type': 'paragraph', 'content': 'Exploitation requires user interaction and that the experimental features are explicitly enabled, which reduces the likelihood but does not eliminate the risk.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects instances of @backstage/plugin-auth-backend prior to version 0.27.1 where experimental features Dynamic Client Registration or Client ID Metadata Documents are enabled and allowedRedirectUriPatterns are configured.

Detection involves verifying if your Backstage instance is running a vulnerable version of the plugin and if the experimental features are enabled with allowedRedirectUriPatterns configured.

There are no specific network or system commands provided in the available resources to detect exploitation attempts or presence of this vulnerability.

A practical approach is to check the version of the @backstage/plugin-auth-backend package and inspect the configuration for experimental features related to Dynamic Client Registration or Client ID Metadata Documents.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the @backstage/plugin-auth-backend package to version 0.27.1 or later, where this vulnerability is fixed.

As a workaround, if upgrading is not immediately possible, disable the experimental features Dynamic Client Registration and Client ID Metadata Documents if they are enabled, to prevent exploitation.

Useful 0 Not Useful 0