CVE-2026-32235

CVE-2026-32235 details a redirect URI allowlist bypass vulnerability in the experimental OIDC provider of Backstage's @backstage/plugin-auth-backend, affecting versions prior to 0.27.1. This flaw allows a specially crafted redirect URI to bypass validation, potentially redirecting an authorization code to an attacker if specific experimental features are enabled and a victim interacts. Rated Medium with a CVSS score of 4.7, exploitation requires high attack complexity due to necessary victim interaction and the explicit enablement of non-default experimental features. Successful exploitation could lead to limited compromise of confidentiality and integrity by allowing an attacker to obtain a victim's access token. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.