@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.14-next.1) +11 more potentially affected by CVE-2026-32235 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.27.1-next.2)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =1.0.0,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.14-next.1) +11 more potentially affected by CVE-2026-32235 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.27.1-next.2)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =1.0.0,...

CVE-2026-32235: URL Redirection to Untrusted Site

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents a...

CVE-2026-32236: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery SSRF vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial clientid...

MAL-2025-145489 Malicious code in nightwatch-terser-webpack-plugin-auth-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8330b970ea27a9a8326babaa86a72618b895c2a775a610dbb6a8d80ff93ff11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend

Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but i...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.0.0-nightly-20240928023157), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.0.0-nightly-20260928023907) +4 more potentially affected by CVE-2021-43776 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.0.0-nightly-20260928023907)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =0.0.0-nightly-2022122206 Source cves:...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.0.0-nightly-20240928023157), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.0.0-nightly-20260928023907) +4 more potentially affected by CVE-2021-43776 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.0.0-nightly-20260928023907)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =0.0.0-nightly-2022122206 Source cves:...

CVE-2021-43776

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other...

CVE-2021-43776 XSS vulnerability in @backstage/plugin-auth-backend

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other...

CVE-2021-43776

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.0.0-nightly-20240928023157), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.0.0-nightly-20260928023907) +4 more potentially affected by CVE-2021-43776 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.0.0-nightly-20260928023907)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =0.0.0-nightly-2022122206 Source cves:...

CVE-2021-43776: Improper Neutralization of Input During Web Page Generation

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other...

PT-2021-23925

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-auth-backend versions prior to 0.4.9 Description: The auth-backend plugin in Backstage allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack, potentially allowing the...