CVE-2026-32235: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32235 is an OAuth redirect URI allowlist bypass vulnerability in the @backstage/plugin-auth-backend npm package, specifically within its experimental OIDC provider. It affects all versions prior to 0.27.1 of the package (part of the Linux Foundation's Backstage project). The advisory was published on March 11, 2026, and assigned a CVSS v3.1 base score of 5.9 (Medium) by the GitHub Advisory Database (Github Advisory). Only instances with experimental Dynamic Client Registration or Client ID Metadata Documents explicitly enabled and allowedRedirectUriPatterns configured are affected — this is not the default configuration (Backstage Advisory).

The root cause is improper input validation (CWE-20) combined with URL redirection to an untrusted site (CWE-601). The original redirect URI validation in OidcService.ts matched raw URI strings against the configured allowedRedirectUriPatterns allowlist without normalizing the URI first. An attacker could craft a URI using the URL userinfo syntax (e.g., http://localhost:3000@attacker.example/callback), which passes the pattern match against http://localhost:* but actually resolves to attacker.example as the host (Backstage Commit). The fix introduces a validateRedirectUri function that normalizes the URI to protocol + host + pathname before pattern matching, stripping any userinfo component (Backstage Commit).

If successfully exploited, an attacker can redirect a victim's OAuth authorization code to an attacker-controlled server, then exchange it for a valid access token to the Backstage instance. This results in high confidentiality impact (unauthorized access to resources protected by the token) and low integrity impact (potential for unauthorized actions on behalf of the victim). Availability is not affected. The attack requires the victim to actively approve the OAuth consent request, limiting the blast radius, but a stolen token could enable lateral movement within the developer portal and access to sensitive internal tooling or catalog data (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.033%, indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, user interaction, and a non-default configuration (experimental features must be explicitly enabled), significantly limiting the realistic attacker population (Backstage Advisory).

1. Reconnaissance: Identify Backstage instances running @backstage/plugin-auth-backend < 0.27.1 with experimental Dynamic Client Registration or Client ID Metadata Documents enabled and allowedRedirectUriPatterns configured.
2. Craft malicious redirect URI: Construct a URI using URL userinfo syntax that matches the allowlist pattern but resolves to an attacker-controlled host — e.g., if the pattern is http://localhost:*, craft http://localhost:3000@attacker.example/callback.
3. Register malicious client: Use the Dynamic Client Registration endpoint to register an OAuth client with the crafted redirect URI, which passes the flawed allowlist validation.
4. Deliver phishing link: Send the victim an OAuth authorization link that initiates a consent flow using the registered malicious client and redirect URI.
5. Capture authorization code: When the victim approves the consent request, the authorization code is sent to attacker.example instead of the legitimate application.
6. Exchange for access token: Use the captured authorization code along with the registered client credentials to request a valid access token from the Backstage OIDC token endpoint, gaining unauthorized access (Backstage Advisory, Backstage Commit).

• Network: Outbound OAuth authorization code redirects to unexpected external hosts (not matching configured allowedRedirectUriPatterns legitimate destinations); HTTP requests to the Dynamic Client Registration endpoint registering URIs containing @ in the host portion.
• Logs: Backstage auth-backend logs showing client registrations with redirect URIs containing userinfo syntax (e.g., http://legitimate-host@external-domain/path); OAuth token exchange requests from IP addresses not associated with registered legitimate clients.
• Application: Newly registered OAuth clients with suspicious clientName values or redirect URIs containing @ characters in the authority component; unexpected entries in the OIDC client database.

Upgrade @backstage/plugin-auth-backend to version 0.27.1 or later, which normalizes redirect URIs before allowlist validation to prevent userinfo-based bypass (Backstage Advisory). As an immediate workaround, disable the experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required — doing so eliminates the attack surface entirely since the vulnerability only affects instances with these non-default features enabled (Github Advisory). A Red Hat errata (RHSA-2026:24841) has also been issued for affected Red Hat products (Red Hat Errata).