@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

中 4.7CVE-2026-32235 · GHSA-wqvh-63mv-9w92 · 12/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-32235 は backstage (linuxfoundation), @backstage/plugin-auth-backend に影響する深刻度「中」 (CVSS 4.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.15%（全脆弱性の 4.0% より高い）。
対処：0.27.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
backstage linuxfoundation	`≤ 0.27.0`	修正版なし
@backstage/plugin-auth-backend npm	`< 0.27.1`	`0.27.1`

概要

Impact

The experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected.

A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.

This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.

Patches

Upgrade to @backstage/plugin-auth-backend version 0.27.1 or later.

Workarounds

Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.

References

RFC 6749 Section 3.1.2 - Redirection Endpoint

NVD の説明

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.