5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32235

CVE-2026-32235: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32235

CVE-2026-32235:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@backstage/plugin-auth-backend	npm	< 0.27.1	0.27.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect caused by improper validation of the redirect_uri parameter in the experimental OIDC provider of @backstage/plugin-auth-backend. The core issue was in the OidcService class, where the registerClient and getRedirectUri methods used a simple string-based pattern match to validate redirect URIs. This method was insufficient because it did not correctly handle URIs containing a userinfo component (e.g., http://username@hostname). An attacker could craft a URI such as http://expected-host.com@attacker.com/callback. The validation logic would see http://expected-host.com and approve the redirect, but the browser would actually send the user and their authorization code to attacker.com. The patch addresses this by introducing a validateRedirectUri function that parses the URI, strips any userinfo by reconstructing the URL from its protocol, host, and pathname, and then performs the pattern match on the normalized URI. This ensures that the validation is performed on the actual host the user will be redirected to.

Vulnerable functions

OidcService.registerClient

plugins/auth-backend/src/service/OidcService.ts

The `registerClient` function was vulnerable to a redirect URI allowlist bypass. It validated the `redirectUri` by performing a direct string match against allowed patterns. This could be bypassed using a URL containing userinfo (e.g., `http://allowed.com@attacker.com`), where the validation would incorrectly pass based on `allowed.com`, but the user would be redirected to `attacker.com`. The patch replaces this flawed logic with a call to `validateRedirectUri`, which normalizes the URL before validation.

OidcService.getRedirectUri

plugins/auth-backend/src/service/OidcService.ts

The `getRedirectUri` function was vulnerable to the same redirect URI allowlist bypass as `registerClient`. It used a direct string match for validation, which could be tricked by a URL containing a userinfo component. This could allow an attacker to have the authorization code sent to a malicious site. The patch fixes this by using the new `validateRedirectUri` function to normalize the URL before checking it against the allowlist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.