CVE-2026-32235

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.

• CWE-601

• https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92Vendor Advisory

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account m…6.8
• CVE-2026-3223Arbitrary file write & potential privilege escalation exploi…7.8
• CVE-2026-32230Uptime Kuma is an open source, self-hosted monitoring tool. …5.3
• CVE-2026-32231ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the ge…8.2
• CVE-2026-32232ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there …9.8
• CVE-2026-32234Parse Server is an open source backend that can be deployed …4.7
• CVE-2026-32236Backstage is an open framework for building developer portal…7.5
• CVE-2026-32237Backstage is an open framework for building developer portal…6.5
• CVE-2026-32238OpenEMR is a free and open source electronic health records …9.1
• CVE-2026-32239Cap'n Proto is a data interchange format and capability-base…6.5
• CVE-2026-3224Authentication bypass in the Microsoft Entra ID (Azure AD) a…9.8
• CVE-2026-32240Cap'n Proto is a data interchange format and capability-base…6.5