fix(deps): update dependency @backstage/plugin-auth-backend to ^0.27.0 by mend-on-mend[bot] · Pull Request #43 · mend/backstage-community-plugins

mend-on-mend · 2026-03-14T06:40:48Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-auth-backend (source)	`^0.25.2` → `^0.27.0`
@backstage/plugin-auth-backend (source)	`^0.25.0` → `^0.27.0`
@backstage/plugin-auth-backend (source)	`^0.25.3` → `^0.27.0`
@backstage/plugin-auth-backend (source)	`^0.25.1` → `^0.27.0`
@backstage/plugin-auth-backend (source)	`^0.24.4` → `^0.27.0`

@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

CVE-2026-32235 / GHSA-wqvh-63mv-9w92

More information

Details

Impact

The experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected.

A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.

This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.

Patches

Upgrade to @backstage/plugin-auth-backend version 0.27.1 or later.

Workarounds

Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.

References

RFC 6749 Section 3.1.2 - Redirection Endpoint

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

CVE-2026-32236 / GHSA-qp4c-xg64-7c6x

More information

Details

Impact

A Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD
metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects.

The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly
enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected.

Patches

Patched in @backstage/plugin-auth-backend version 0.27.1. The fix disables HTTP redirect following when fetching CIMD metadata documents.

Workarounds

Disable the experimental CIMD feature by removing or setting auth.experimentalClientIdMetadataDocuments.enabled to false in your app-config. This is the default configuration.
Alternatively, restrict allowedClientIdPatterns to specific trusted domains rather than using the default wildcard pattern.

References

Severity

CVSS Score: 0.0 / 10 (None)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@backstage/plugin-auth-backend)

`v0.27.1`

Compare Source

Patch Changes

d0f4cd2: Added optional client metadata document endpoint at /.well-known/oauth-client/cli.json relative to the auth backend base URL for CLI authentication. Enabled when auth.experimentalClientIdMetadataDocuments.enabled is set to true.
Updated dependencies
- @backstage/backend-plugin-api@1.8.0-next.1
- @backstage/plugin-auth-node@0.6.14-next.2
- @backstage/plugin-catalog-node@2.1.0-next.2

`v0.27.0`

Compare Source

Minor Changes

31de2c9: Added experimental support for Client ID Metadata Documents (CIMD).

This allows Backstage to act as an OAuth 2.0 authorization server that supports the IETF Client ID Metadata Document draft. External OAuth clients can use HTTPS URLs as their client_id, and Backstage will fetch metadata from those URLs to validate the client.

Configuration example:

auth:
  experimentalClientIdMetadataDocuments:
    enabled: true
    # Optional: restrict which `client_id` URLs are allowed (defaults to ['*'])
    allowedClientIdPatterns:
      - 'https://example.com/*'
      - 'https://*.trusted-domain.com/*'
    # Optional: restrict which redirect URIs are allowed (defaults to ['*'])
    allowedRedirectUriPatterns:
      - 'http://localhost:*'
      - 'https://*.example.com/*'

Clients using CIMD must host a JSON metadata document at their client_id URL containing at minimum:

{
  "client_id": "https://example.com/.well-known/oauth-client/my-app",
  "client_name": "My Application",
  "redirect_uris": ["http://localhost:8080/callback"],
  "token_endpoint_auth_method": "none"
}

d0786b9: Added experimental support for refresh tokens via the auth.experimentalRefreshToken.enabled configuration option. When enabled, clients can request the offline_access scope to receive refresh tokens that can be used to obtain new access tokens without re-authentication.

Patch Changes

7dc3dfe: Removed the auth.experimentalDynamicClientRegistration.tokenExpiration config option. DCR tokens now use the default 1 hour expiration.

If you need longer-lived access, use refresh tokens via the offline_access scope instead. DCR clients should already have the offline_access scope available. Enable refresh tokens by setting:
```
auth:
  experimentalRefreshToken:
    enabled: true
```
7455dae: Use node prefix on native imports
Updated dependencies
- @backstage/plugin-catalog-node@2.0.0
- @backstage/backend-plugin-api@1.7.0
- @backstage/plugin-auth-node@0.6.13

`v0.26.0`

Compare Source

Minor Changes

7ffc873: Fix user_created_at migration causing SQLiteError regarding use of non-constants for defaults

Patch Changes

Updated dependencies
- @backstage/backend-plugin-api@1.6.1
- @backstage/plugin-auth-node@0.6.11

`v0.25.7`

Compare Source

Patch Changes

de96a60: chore(deps): bump express from 4.21.2 to 4.22.0
Updated dependencies
- @backstage/plugin-auth-node@0.6.10
- @backstage/backend-plugin-api@1.6.0
- @backstage/plugin-catalog-node@1.20.1

`v0.25.6`

Compare Source

Patch Changes

a9315d0: Change internal state column to text to support state of over 255 characters
05f60e1: Refactored constructor parameter properties to explicit property declarations for compatibility with TypeScript's erasableSyntaxOnly setting. This internal refactoring maintains all existing functionality while ensuring TypeScript compilation compatibility.
51ff7d8: Allow configuring dynamic client registration token expiration with config auth.experimentalDynamicClientRegistration.tokenExpiration.

Maximum expiration for the DCR token is 24 hours. Default expiration is 1 hour.
Updated dependencies
- @backstage/plugin-catalog-node@1.20.0
- @backstage/backend-plugin-api@1.5.0
- @backstage/plugin-auth-node@0.6.9
- @backstage/config@1.3.6
- @backstage/catalog-model@1.7.6

Patch Changes

1d47bf3: Implementing Dynamic Client Registration with the OIDC server. You can enable this by setting auth.experimentalDynamicClientRegistration.enabled in app-config.yaml. This is highly experimental, but feedback welcome.
54ddfef: Updating plugin metadata
Updated dependencies
- @backstage/plugin-catalog-node@1.19.0
- @backstage/plugin-auth-node@0.6.7
- @backstage/types@1.2.2
- @backstage/backend-plugin-api@1.4.3

`v0.25.3`

Compare Source

Patch Changes

Updated dependencies
- @backstage/plugin-catalog-node@1.18.0
- @backstage/plugin-auth-node@0.6.6
- @backstage/backend-plugin-api@1.4.2

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>

mend-on-mend · 2026-03-14T08:17:41Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

fix(deps): update dependency @backstage/plugin-auth-backend to ^0.27.0

9196927

Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>

mend-on-mend bot requested review from NormanWenzelWSS, hetsaliya-crestdata and rupalvihol as code owners March 14, 2026 06:40

mend-on-mend bot added dependencies security labels Mar 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency @backstage/plugin-auth-backend to ^0.27.0#43

fix(deps): update dependency @backstage/plugin-auth-backend to ^0.27.0#43
mend-on-mend[bot] wants to merge 1 commit intomainfrom
whitesource-remediate/npm-backstage-plugin-auth-backend-vulnerability

mend-on-mend bot commented Mar 14, 2026

Uh oh!

mend-on-mend bot commented Mar 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

mend-on-mend bot commented Mar 14, 2026

@​backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

Details

Impact

Patches

Workarounds

References

Severity

References

@​backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

mend-on-mend bot commented Mar 14, 2026

Edited/Blocked Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch