TI-2026-24764 Aliases CVE-2026-32235 GHSA-wqvh-63mv-9w92

@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

LOW 26CWE-601Published 2026-03-12 · Updated 2026-03-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · Low · None
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00167 6th percentileScored 2026-11-07

Fix Partial plugin-auth-backend (@backstage): 0.27.1@backstage/plugin-auth-backend (npm): 0.27.1Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	plugin-auth-backend	before 0.27.1	0.27.1	Patch available	CNA
—	@backstage/plugin-auth-backend (npm)	before 0.27.1	0.27.1	Patch available	GHSA-wqvh-63mv-9w92

plugin-auth-backend Vendorbackstage Affected before 0.27.1 Fixed in 0.27.1 Patch available CNA
@backstage/plugin-auth-backend (npm) Vendor— Affected before 0.27.1 Fixed in 0.27.1 Patch available GHSA-wqvh-63mv-9w92

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:backstage::::::::	up to 0.27.0	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* Versions up to 0.27.0 Vulnerable ·backstage

Remediation

Fix · CNA plugin-auth-backend (@backstage) Fixed in 0.27.1
Fix · GHSA-wqvh-63mv-9w92 @backstage/plugin-auth-backend (npm) Fixed in 0.27.1 Advisory →

Red Hat 1 advisory

RHSA-2026:24841 Released 2026-06-09 · Red Hat rating Moderate
Red Hat Developer Hub 1.10.0 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Self-service automation portal 2	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1.10	Fixed	RHSA-2026:24841

Not affected: 1 product

Red Hat Developer Hub 1.10

Timeline

2026-10-02 Threatist record created from CVE-2026-32235
2026-10-03 Alias added: GHSA-wqvh-63mv-9w92

References

Advisory 2

Other 2

TI-2023-17988 Insecure sandbox in Backstage Scaffolder plugin CVSS 3.1CRITICAL 9.9
TI-2026-69075 Sensitive information exposure in Backstage Scaffolder CVSS 3.1CRITICAL 9.6
TI-2026-69061 Path traversal in Backstage Bitbucket pull-request scaffolder actions CVSS 3.1CRITICAL 9.9
TI-2026-60083 Backstage: Improper input validation in TechDocs MkDocs configuration CVSS 3.1HIGH 8.8
TI-2026-69165 Backstage TechDocs config flaw allows code execution CVSS 3.1HIGH 8.8
TI-2026-69083 Code injection via MkDocs theme configuration in Backstage TechDocs CVSS 3.1HIGH 8.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences