Executive brief
A vulnerability in the Backstage authentication plugin could allow an attacker to hijack user accounts by bypassing security filters for login redirects. By exploiting a flaw in how the system validates trusted web addresses, an attacker could trick the system into sending sensitive login codes to a server they control. This issue only affects organizations that have manually enabled certain experimental features and configured them with specific wildcard settings.
Technical details
The vulnerability is an 'Open Redirect' (CWE-601) caused by improper glob pattern matching in the experimental dynamic client registration and client ID metadata document (CIMD) features. The allowlist logic matched patterns against the full URL string rather than individual components, allowing a wildcard (*) to match across host and path boundaries (e.g., 'https://*.example.com' matching 'https://attacker.example/x.example.com'). An attacker can exploit this to register a malicious OAuth client and intercept authorization codes. The issue is mitigated by the fact that these features are disabled by default. A fix is available in version 0.29.2 which implements component-wise URL matching.
Affected products
- Backstage @backstage/plugin-auth-backend <= 0.29.1
Timeline
- 2026-07-15: disclosed
- 2026-07-24: advisory
References
- https://github.com/backstage/backstage/security/advisories/GHSA-38hq-7x33-php4
- https://github.com/backstage/backstage/commit/274acc51d22a7dd919cdda49d9086cf12c0b8711
- https://github.com/backstage/backstage/commit/6370e53bce8b227c63092300594ffde29c006886
- https://github.com/backstage/backstage/commit/ef606a85545cb6d765e20afd1ff43ae5407a3660
- https://github.com/backstage/backstage/commit/fdc0d2dcd9a571e3839d7f5de4133c4e242a3a41
- https://github.com/backstage/backstage/releases/tag/v1.53.0