Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document (CIMD) features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as https://.example.com/callback, intended to allow subdomains of a trusted host, would also match an attacker-controlled URL such as https://attacker.example/x.example.com/callback. This applies to auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns as well as the allowedClientIdPatterns and allowedRedirectUriPatterns options of auth.experimentalClientIdMetadataDocuments. An attacker could use this to register an OAuth client whose redirect URI points to a host they control while still passing the allowlist, causing authorization codes to be delivered to the attacker when a victim completes an authorization flow. In addition, allowlist patterns without an explicit protocol…
Recommended action: Upgrade to 0.29.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial clientid hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected. Patches Patched in @backstage/plugin-auth-backend version 0.27.1. The fix disables HTTP redirect following when fetching CIMD metadata documents. Workarounds Disable the experimental CIMD feature by removing or setting auth.experimentalClientIdMetadataDocuments.enabled to false in your app-config. This is the default configuration.…
Recommended action: Upgrade to 0.27.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. Patches Upgrade to @backstage/plugin-auth-backend version 0.27.1 or later. Workarounds Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required. References - RFC 6749 Section 3.1.2 - Redirection Endpoint
Recommended action: Upgrade to 0.27.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. Patches This is vulnerability is patched in version 0.4.9 of @backstage/plugin-auth-backend. For more information If you have any questions or comments about this advisory: Open an issue in the Backstage repository Visit our chat, linked to in Backstage README
Recommended action: Upgrade to 0.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.