Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g3nc-3rdj-akh2
Vulnerability ID VCID-g3nc-3rdj-akh2
Aliases CVE-2026-32235
GHSA-wqvh-63mv-9w92
Summary Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token. This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default. This vulnerability is fixed in 0.27.1.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32235.json
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2026-32235
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2026-32235
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2026-32235
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2026-32235
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-wqvh-63mv-9w92
cvssv3.1 5.9 https://github.com/backstage/backstage
generic_textual MODERATE https://github.com/backstage/backstage
cvssv3.1 5.9 https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec
generic_textual MODERATE https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec
cvssv3.1 5.9 https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
cvssv3.1_qr MODERATE https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
generic_textual MODERATE https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
ssvc Track https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2026-32235
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-32235
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32235.json
https://api.first.org/data/v1/epss?cve=CVE-2026-32235
https://github.com/backstage/backstage
https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec
https://nvd.nist.gov/vuln/detail/CVE-2026-32235
2447075 https://bugzilla.redhat.com/show_bug.cgi?id=2447075
GHSA-wqvh-63mv-9w92 https://github.com/advisories/GHSA-wqvh-63mv-9w92
GHSA-wqvh-63mv-9w92 https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
RHSA-2026:24841 https://access.redhat.com/errata/RHSA-2026:24841
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32235.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/backstage/backstage
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/backstage/backstage/commit/6042dd0c7f0706e0f473dafa92799ecf19c825ec
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-12T20:38:14Z/ Found at https://github.com/backstage/backstage/security/advisories/GHSA-wqvh-63mv-9w92
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-32235
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.10067
EPSS Score 0.00033
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:49:17.176821+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/32xxx/CVE-2026-32235.json 38.6.0