Open Redirect Affecting @backstage/plugin-auth-backend package, versions <0.29.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BACKSTAGEPLUGINAUTHBACKEND-18313046
- published26 Jul 2026
- disclosed24 Jul 2026
- creditPatrik Oldsberg
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-601 (opens in a new tab)How to fix?
Upgrade @backstage/plugin-auth-backend to version 0.29.2 or higher.
Overview
@backstage/plugin-auth-backend is an A Backstage backend plugin that handles authentication
Affected versions of this package are vulnerable to Open Redirect via the allowlist matching process. An attacker can intercept authorization codes by registering an OAuth client with a crafted redirect_uri that bypasses intended restrictions, causing sensitive tokens to be delivered to an attacker-controlled endpoint. This is only exploitable if experimental features for dynamic client registration or client ID metadata documents are enabled and custom allowlist patterns with wildcards or missing protocols are configured.
Workaround
This vulnerability can be mitigated by disabling the experimental features or restricting allowlist patterns to fully specified URLs with explicit protocols and without wildcards in the hostname.