Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/%40backstage/plugin-auth-backend@0.3.6
Typenpm
Namespace@backstage
Nameplugin-auth-backend
Version0.3.6
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.27.1
Latest_non_vulnerable_version0.27.1
Affected_by_vulnerabilities
0
url VCID-fbze-e7b9-xfc4
vulnerability_id VCID-fbze-e7b9-xfc4
summary Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-43776
reference_id
reference_type
scores
0
value 0.00311
scoring_system epss
scoring_elements 0.54802
published_at 2026-06-14T12:55:00Z
1
value 0.00311
scoring_system epss
scoring_elements 0.54677
published_at 2026-06-11T12:55:00Z
2
value 0.00311
scoring_system epss
scoring_elements 0.54801
published_at 2026-06-12T12:55:00Z
3
value 0.00311
scoring_system epss
scoring_elements 0.54818
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-43776
1
reference_url https://github.com/backstage/backstage
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage
2
reference_url https://github.com/backstage/backstage/tree/master/plugins/auth-backend
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage/tree/master/plugins/auth-backend
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-43776
reference_id CVE-2021-43776
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-43776
4
reference_url https://github.com/advisories/GHSA-w7fj-336r-vw49
reference_id GHSA-w7fj-336r-vw49
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w7fj-336r-vw49
5
reference_url https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49
reference_id GHSA-w7fj-336r-vw49
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49
fixed_packages
0
url pkg:npm/%40backstage/plugin-auth-backend@0.4.9
purl pkg:npm/%40backstage/plugin-auth-backend@0.4.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-g3nc-3rdj-akh2
1
vulnerability VCID-k15p-db8h-sqbz
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-auth-backend@0.4.9
aliases CVE-2021-43776, GHSA-w7fj-336r-vw49
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fbze-e7b9-xfc4
1
url VCID-g3nc-3rdj-akh2
vulnerability_id VCID-g3nc-3rdj-akh2
summary Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32235.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32235.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-32235
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.10113
published_at 2026-06-12T12:55:00Z
1
value 0.00033
scoring_system epss
scoring_elements 0.10103
published_at 2026-06-14T12:55:00Z
2
value 0.00033
scoring_system epss
scoring_elements 0.10067
published_at 2026-06-11T12:55:00Z
3
value 0.00033
scoring_system epss
scoring_elements 0.10119
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-32235
2
reference_url https://github.com/backstage/backstage
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage
3
reference_url https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-32235
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-32235
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2447075
reference_id 2447075
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2447075
6
reference_url https://github.com/advisories/GHSA-wqvh-63mv-9w92
reference_id GHSA-wqvh-63mv-9w92
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wqvh-63mv-9w92
7
reference_url https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
reference_id GHSA-wqvh-63mv-9w92
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:38:14Z/
url https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
8
reference_url https://access.redhat.com/errata/RHSA-2026:24841
reference_id RHSA-2026:24841
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:24841
fixed_packages
0
url pkg:npm/%40backstage/plugin-auth-backend@0.27.1
purl pkg:npm/%40backstage/plugin-auth-backend@0.27.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-auth-backend@0.27.1
aliases CVE-2026-32235, GHSA-wqvh-63mv-9w92
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g3nc-3rdj-akh2
2
url VCID-k15p-db8h-sqbz
vulnerability_id VCID-k15p-db8h-sqbz
summary 
Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD
metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected. Patched in @backstage/plugin-auth-backend version 0.27.1.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32236.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32236.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-32236
reference_id
reference_type
scores
0
value 0.00047
scoring_system epss
scoring_elements 0.15013
published_at 2026-06-13T12:55:00Z
1
value 0.00047
scoring_system epss
scoring_elements 0.14985
published_at 2026-06-14T12:55:00Z
2
value 0.00047
scoring_system epss
scoring_elements 0.14894
published_at 2026-06-11T12:55:00Z
3
value 0.00047
scoring_system epss
scoring_elements 0.15014
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-32236
2
reference_url https://github.com/backstage/backstage
reference_id
reference_type
scores
0
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-32236
reference_id
reference_type
scores
0
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-32236
4
reference_url https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07
reference_id 17038abf2dfdb4abc08a59b1c95af39851de0e07
reference_type
scores
0
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:38:12Z/
url https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2447090
reference_id 2447090
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2447090
6
reference_url https://github.com/advisories/GHSA-qp4c-xg64-7c6x
reference_id GHSA-qp4c-xg64-7c6x
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qp4c-xg64-7c6x
7
reference_url https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x
reference_id GHSA-qp4c-xg64-7c6x
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
1
value 1.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:38:12Z/
url https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x
fixed_packages
0
url pkg:npm/%40backstage/plugin-auth-backend@0.27.1
purl pkg:npm/%40backstage/plugin-auth-backend@0.27.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-auth-backend@0.27.1
aliases CVE-2026-32236, GHSA-qp4c-xg64-7c6x
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k15p-db8h-sqbz
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-auth-backend@0.3.6