CVE-2026-32235

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32235", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T14:47:05.683Z", "datePublished": "2026-03-12T18:35:06.325Z", "dateUpdated": "2026-03-12T20:46:46.618Z"}, "containers": {"cna": {"title": "@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92"}], "affected": [{"vendor": "@backstage", "product": "plugin-auth-backend", "versions": [{"version": "< 0.27.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T18:35:06.325Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1."}], "source": {"advisory": "GHSA-wqvh-63mv-9w92", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T20:38:14.280151Z", "id": "CVE-2026-32235", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:46:46.618Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32235", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T20:38:14.280151Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:38:14.902Z"}}], "cna": {"title": "@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass", "source": {"advisory": "GHSA-wqvh-63mv-9w92", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "@backstage", "product": "plugin-auth-backend", "versions": [{"status": "affected", "version": "< 0.27.1"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T18:35:06.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32235", "state": "PUBLISHED", "dateUpdated": "2026-03-12T20:46:46.618Z", "dateReserved": "2026-03-11T14:47:05.683Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T18:35:06.325Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "plugin-auth-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.27.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF2B3D86-9F1F-492C-A156-5DF20A14460C", "versionEndIncluding": "0.27.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1."}, {"lang": "es", "value": "Backstage es un framework abierto para construir portales de desarrolladores. Antes de la versi\u00f3n 0.27.1, el proveedor OIDC experimental en @backstage/plugin-auth-backend es vulnerable a un bypass de la lista de permitidos de URI de redirecci\u00f3n. Las instancias que han habilitado el Registro Din\u00e1mico de Clientes experimental o los Documentos de Metadatos de ID de Cliente y han configurado allowedRedirectUriPatterns se ven afectadas. Una URI de redirecci\u00f3n especialmente dise\u00f1ada puede pasar la validaci\u00f3n de la lista de permitidos mientras se resuelve a un host controlado por el atacante. Si una v\u00edctima aprueba la solicitud de consentimiento de OAuth resultante, su c\u00f3digo de autorizaci\u00f3n se env\u00eda al atacante, quien puede intercambiarlo por un token de acceso v\u00e1lido. Esto requiere la interacci\u00f3n de la v\u00edctima y que una de las caracter\u00edsticas experimentales est\u00e9 expl\u00edcitamente habilitada, lo cual no es el valor predeterminado. Esta vulnerabilidad se corrige en la versi\u00f3n 0.27.1."}], "id": "CVE-2026-32235", "lastModified": "2026-06-17T10:35:23.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32235", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T20:38:14.280151Z", "version": "2.0.3"}}]}, "published": "2026-03-12T19:16:17.443", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass", "id": "2447075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447075"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["An allowlist bypass flaw has been discovered in the npm @backstage/plugin-auth-backend package. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-32235", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-03-12T18:35:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32235\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32235\nhttps://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.27.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-auth-backend", "source": "cna", "vendor": "@backstage"}, "product": "plugin-auth-backend", "vendor": "backstage"}], "analysis": {"en": {"generated_at": "2026-03-19T22:35:44.023360+00:00", "value": {"mitigation_remediation": ["Upgrade Backstage to version 0.27.1 or later to remove the vulnerability.", "Disable experimental Dynamic Client Registration and Client ID Metadata Documents if you do not need them.", "Review and tighten allowedRedirectUriPatterns to only include trusted hosts.", "Verify that redirect URIs do not resolve to attacker-controlled domains.", "Monitor OAuth consent logs for suspicious approvals and configure alerts."], "summary": {"action": "Patch", "impact": "Authorization Code Interception"}, "threat_synthesis": {"affected_systems": "Any Backstage instance using @backstage/plugin-auth-backend prior to version 0.27.1 is affected, provided that the experimental Dynamic Client Registration or Client ID Metadata Documents features are enabled and allowedRedirectUriPatterns are configured. The vulnerability is present in all versions below 0.27.1 that include the experimental OIDC provider.", "description_and_impact": "The vulnerability arises from the experimental OIDC provider in @backstage/plugin-auth-backend, which performs insufficient validation of redirect URIs against an allowlist. An attacker can craft a redirect URI that satisfies the allowlist pattern while targeting an attacker-controlled host. When a user authorizes the request, the resulting OAuth authorization code is sent to the attacker, who can then exchange it for a valid access token. This allows the attacker to obtain unauthorized access tokens, potentially compromising the confidentiality and integrity of protected resources. The weakness is identified as CWE-601 (Open Redirect).", "risk_and_exploitability": "The CVSS score of 5.9 indicates moderate severity. EPSS suggests exploitation probability is below 1\u202f%, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the victim to interact with the OAuth consent flow and the attacker must have an enabled experimental feature. The attack vector is network-based via OAuth, but necessitates user authorization. Because it relies on feature configuration and victim interaction, the overall risk to an unconfigured or unmanaged instance is limited, though impacted deployments should still remediate promptly."}}}}, "created": "2026-03-13T09:50:19.647426+00:00", "updated": "2026-03-23T09:55:03.023852+00:00", "vendors": ["backstage", "backstage$PRODUCT$plugin-auth-backend"]}