PT-2026-25051 · Npm+3 · @Backstage/Plugin-Auth-Backend+2
Benjdlambert
·
Publicado
2026-03-12
·
Atualizado
2026-03-12
·
CVE-2026-32235
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Backstage versions prior to 0.27.1
Description
Backstage, an open framework for building developer portals, has an issue in the experimental OIDC provider within the
@backstage/plugin-auth-backend component. Specifically, a redirect URI allowlist bypass can occur in instances where experimental Dynamic Client Registration or Client ID Metadata Documents are enabled and allowedRedirectUriPatterns are configured. A crafted redirect URI can bypass validation and resolve to a host controlled by an attacker. If a user approves the resulting OAuth consent request, their authorization code is sent to the attacker, allowing them to obtain a valid access token. This requires user interaction and the explicit enabling of one of the experimental features, which is not the default configuration. The vulnerable component utilizes the allowedRedirectUriPatterns variable for validation.Recommendations
Upgrade to
@backstage/plugin-auth-backend version 0.27.1 or later.
Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.Exploit
Correção
RCE
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
@Backstage/Plugin-Auth-Backend
Backstage
Plugin-Auth-Backend