CVE-2026-32235: @backstage plugin-auth-backend Open Redirect

Vulnerability summary

CVE-2026-32235 is a medium (CVSS 5.9) Open Redirect vulnerability in @backstage plugin-auth-backend. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.5% of scored vulnerabilities.

Timeline

1. 12-03-2026
   PublishedVulnerability first disclosed.
2. 12-03-2026
   Last modifiedVulnerability information updated.

Description

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.