CVE-2026-32235 @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
Attackers can bypass OAuth redirect URI allowlists in experimental Backstage auth features to steal authorization codes and access tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32235?
CVE-2026-32235 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.
Weakness: CWE-601
Which versions are affected by CVE-2026-32235?
2 open source packages ship an affected version, including @backstage/plugin-auth-backend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-auth-backend npm | All versions | 0.27.1 |
@backstage/plugin-auth-backend npm | All versions | 0.27.1 |
Products include Linuxfoundation Backstage.
How do I fix CVE-2026-32235?
Upgrade @backstage/plugin-auth-backend to 0.27.1 or later.
Is CVE-2026-32235 being exploited?
There is no known exploitation of CVE-2026-32235 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-wqvh-63mv-9w92, ROOT-APP-NPM-CVE-2026-32235.