Skip to content
OpenAdvisories

Product · backstage

plugin-auth-backend

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2026-32235

    @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

    Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registra…

    backstage plugin-auth-backend @backstage/plugin-auth-backend npm