Skip to content
OpenAdvisories

Product · backstage

plugin-auth-backend

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 1.7
    CVE-2026-32236

    @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

    Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metada…

    backstage plugin-auth-backend @backstage/plugin-auth-backend npm