fix(deps): update dependency @backstage/plugin-auth-backend to v0.27.1 [security] - abandoned by backstage-goalie[bot] · Pull Request #9750 · backstage/community-plugins

backstage-goalie · 2026-07-03T18:35:32Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-auth-backend (source)	`^0.25.2` → `^0.27.0`
@backstage/plugin-auth-backend (source)	`0.27.0` → `0.27.1`
@backstage/plugin-auth-backend (source)	`^0.26.0` → `^0.27.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

CVE-2026-32236 / GHSA-qp4c-xg64-7c6x

More information

Details

Impact

A Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD
metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects.

The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly
enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected.

Patches

Patched in @backstage/plugin-auth-backend version 0.27.1. The fix disables HTTP redirect following when fetching CIMD metadata documents.

Workarounds

Disable the experimental CIMD feature by removing or setting auth.experimentalClientIdMetadataDocuments.enabled to false in your app-config. This is the default configuration.
Alternatively, restrict allowedClientIdPatterns to specific trusted domains rather than using the default wildcard pattern.

References

Severity

CVSS Score: 1.7 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

CVE-2026-32235 / GHSA-wqvh-63mv-9w92

More information

Details

Impact

The experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected.

A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.

This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.

Patches

Upgrade to @backstage/plugin-auth-backend version 0.27.1 or later.

Workarounds

Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.

References

RFC 6749 Section 3.1.2 - Redirection Endpoint

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@backstage/plugin-auth-backend)

`v0.27.1`

Compare Source

Patch Changes

d0f4cd2: Added optional client metadata document endpoint at /.well-known/oauth-client/cli.json relative to the auth backend base URL for CLI authentication. Enabled when auth.experimentalClientIdMetadataDocuments.enabled is set to true.
Updated dependencies
- @backstage/backend-plugin-api@1.8.0-next.1
- @backstage/plugin-auth-node@0.6.14-next.2
- @backstage/plugin-catalog-node@2.1.0-next.2

`v0.27.0`

Compare Source

Minor Changes

31de2c9: Added experimental support for Client ID Metadata Documents (CIMD).

This allows Backstage to act as an OAuth 2.0 authorization server that supports the IETF Client ID Metadata Document draft. External OAuth clients can use HTTPS URLs as their client_id, and Backstage will fetch metadata from those URLs to validate the client.

Configuration example:

auth:
  experimentalClientIdMetadataDocuments:
    enabled: true
    # Optional: restrict which `client_id` URLs are allowed (defaults to ['*'])
    allowedClientIdPatterns:
      - 'https://example.com/*'
      - 'https://*.trusted-domain.com/*'
    # Optional: restrict which redirect URIs are allowed (defaults to ['*'])
    allowedRedirectUriPatterns:
      - 'http://localhost:*'
      - 'https://*.example.com/*'

Clients using CIMD must host a JSON metadata document at their client_id URL containing at minimum:

{
  "client_id": "https://example.com/.well-known/oauth-client/my-app",
  "client_name": "My Application",
  "redirect_uris": ["http://localhost:8080/callback"],
  "token_endpoint_auth_method": "none"
}

d0786b9: Added experimental support for refresh tokens via the auth.experimentalRefreshToken.enabled configuration option. When enabled, clients can request the offline_access scope to receive refresh tokens that can be used to obtain new access tokens without re-authentication.

Patch Changes

7dc3dfe: Removed the auth.experimentalDynamicClientRegistration.tokenExpiration config option. DCR tokens now use the default 1 hour expiration.

If you need longer-lived access, use refresh tokens via the offline_access scope instead. DCR clients should already have the offline_access scope available. Enable refresh tokens by setting:
```
auth:
  experimentalRefreshToken:
    enabled: true
```
7455dae: Use node prefix on native imports
Updated dependencies
- @backstage/plugin-catalog-node@2.0.0
- @backstage/backend-plugin-api@1.7.0
- @backstage/plugin-auth-node@0.6.13

`v0.26.0`

Compare Source

Minor Changes

7ffc873: Fix user_created_at migration causing SQLiteError regarding use of non-constants for defaults

Patch Changes

Updated dependencies
- @backstage/backend-plugin-api@1.6.1
- @backstage/plugin-auth-node@0.6.11

`v0.25.7`

Compare Source

Patch Changes

de96a60: chore(deps): bump express from 4.21.2 to 4.22.0
Updated dependencies
- @backstage/plugin-auth-node@0.6.10
- @backstage/backend-plugin-api@1.6.0
- @backstage/plugin-catalog-node@1.20.1

`v0.25.6`

Compare Source

Patch Changes

a9315d0: Change internal state column to text to support state of over 255 characters
05f60e1: Refactored constructor parameter properties to explicit property declarations for compatibility with TypeScript's erasableSyntaxOnly setting. This internal refactoring maintains all existing functionality while ensuring TypeScript compilation compatibility.
51ff7d8: Allow configuring dynamic client registration token expiration with config auth.experimentalDynamicClientRegistration.tokenExpiration.

Maximum expiration for the DCR token is 24 hours. Default expiration is 1 hour.
Updated dependencies
- @backstage/plugin-catalog-node@1.20.0
- @backstage/backend-plugin-api@1.5.0
- @backstage/plugin-auth-node@0.6.9
- @backstage/config@1.3.6
- @backstage/catalog-model@1.7.6

Patch Changes

1d47bf3: Implementing Dynamic Client Registration with the OIDC server. You can enable this by setting auth.experimentalDynamicClientRegistration.enabled in app-config.yaml. This is highly experimental, but feedback welcome.
54ddfef: Updating plugin metadata
Updated dependencies
- @backstage/plugin-catalog-node@1.19.0
- @backstage/plugin-auth-node@0.6.7
- @backstage/types@1.2.2
- @backstage/backend-plugin-api@1.4.3

`v0.25.3`

Compare Source

Patch Changes

Updated dependencies
- @backstage/plugin-catalog-node@1.18.0
- @backstage/plugin-auth-node@0.6.6
- @backstage/backend-plugin-api@1.4.2

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

backstage-goalie · 2026-07-03T18:35:58Z

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage-community/plugin-azure-sites-backend	workspaces/azure-sites/plugins/azure-sites-backend	patch	`v0.16.0`
@backstage-community/plugin-feedback-backend	workspaces/feedback/plugins/feedback-backend	patch	`v2.1.7`
backend	workspaces/report-portal/packages/backend	none	`v0.0.7`
@backstage-community/plugin-report-portal-backend	workspaces/report-portal/plugins/report-portal-backend	patch	`v1.1.2`

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

@@ -0,0 +1,5 @@
+---
+'@backstage-community/plugin-report-portal-backend': patch


Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 2 comments.

  "devDependencies": {
    "@backstage/cli": "^0.33.1",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",


    "@backstage/backend-defaults": "^0.15.1",
    "@backstage/cli": "^0.35.3",
-    "@backstage/plugin-auth-backend": "^0.26.0",
+    "@backstage/plugin-auth-backend": "^0.27.0",


Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (4)

workspaces/report-portal/plugins/report-portal-backend/package.json:50

The PR description references the security patch in @backstage/plugin-auth-backend 0.27.1, but this dependency range still allows 0.27.0. Bump the minimum to ^0.27.1 (and regenerate the lockfile) to ensure the patched version is always selected.

    "@backstage/plugin-auth-backend": "^0.27.0",

workspaces/report-portal/packages/backend/package.json:29

This dependency range allows @backstage/plugin-auth-backend 0.27.0, but the security fix is in 0.27.1+. Set the range to ^0.27.1 and regenerate the lockfile.

    "@backstage/plugin-auth-backend": "^0.27.0",

workspaces/feedback/plugins/feedback-backend/package.json:60

This range still allows @backstage/plugin-auth-backend 0.27.0, while the CVE fixes are in 0.27.1+. Please bump the minimum to ^0.27.1 (and regenerate the lockfile).

    "@backstage/plugin-auth-backend": "^0.27.0",

workspaces/azure-sites/plugins/azure-sites-backend/package.json:61

The patched version for the referenced security advisories is 0.27.1+, but ^0.27.0 permits 0.27.0. Update to ^0.27.1 and regenerate the lockfile.

    "@backstage/plugin-auth-backend": "^0.27.0",

+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/plugin-auth-backend` to `^0.27.0`.


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/plugin-auth-backend` to `^0.27.0`.


+'@backstage-community/plugin-azure-sites-backend': patch
+---
+
+Updated dependency `@backstage/plugin-auth-backend` to `^0.27.0`.


Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

    "@backstage/backend-defaults": "^0.11.1",
    "@backstage/config": "^1.3.3",
    "@backstage/plugin-app-backend": "^0.5.4",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",
    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",
    "@backstage/plugin-auth-node": "^0.6.5",
    "@backstage/plugin-catalog-backend": "^3.0.0",


Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated 1 comment.

    "@backstage/config": "^1.3.3",
    "@backstage/plugin-app-backend": "^0.5.4",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",


Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

@@ -47,7 +47,7 @@
    "@backstage/backend-defaults": "^0.11.1",
    "@backstage/backend-test-utils": "^1.7.0",


Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 3 comments.

  "devDependencies": {
    "@backstage/cli": "^0.33.1",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",
    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",
    "@backstage/plugin-catalog-backend": "^3.0.0",


  "devDependencies": {
    "@backstage/backend-defaults": "^0.15.1",
    "@backstage/cli": "^0.35.3",
-    "@backstage/plugin-auth-backend": "^0.26.0",
+    "@backstage/plugin-auth-backend": "^0.27.0",
    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.15",


    "@backstage/backend-defaults": "^0.11.1",
    "@backstage/config": "^1.3.3",
    "@backstage/plugin-app-backend": "^0.5.4",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",
    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",
    "@backstage/plugin-auth-node": "^0.6.5",
    "@backstage/plugin-catalog-backend": "^3.0.0",


Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",
    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",
    "@backstage/plugin-auth-node": "^0.6.5",


Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

    "@backstage/backend-defaults": "^0.11.1",
    "@backstage/backend-test-utils": "^1.7.0",
    "@backstage/cli": "^0.33.1",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",


Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated no new comments.

…1 [security] Signed-off-by: Renovate Bot <bot@renovateapp.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

    "@backstage/backend-defaults": "^0.11.1",
    "@backstage/config": "^1.3.3",
    "@backstage/plugin-app-backend": "^0.5.4",
-    "@backstage/plugin-auth-backend": "^0.25.2",
+    "@backstage/plugin-auth-backend": "^0.27.0",
    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",
    "@backstage/plugin-auth-node": "^0.6.5",
    "@backstage/plugin-catalog-backend": "^3.0.0",


backstage-goalie · 2026-07-18T13:36:43Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

backstage-goalie · 2026-07-20T01:42:38Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Copilot AI review requested due to automatic review settings July 3, 2026 18:35

backstage-goalie Bot added dependencies Pull requests that update a dependency file security labels Jul 3, 2026

backstage-goalie Bot requested review from deshmukhmayur, riginoommen and yashoswalyo as code owners July 3, 2026 18:35

backstage-goalie Bot added the dependencies Pull requests that update a dependency file label Jul 3, 2026

backstage-goalie Bot requested review from a team, Sarabadu and deepan10 as code owners July 3, 2026 18:35

backstage-goalie Bot added the security label Jul 3, 2026

backstage-goalie Bot requested review from awanlin and Copilot July 3, 2026 18:35

Copilot AI reviewed Jul 3, 2026

backstage-service added workspace/blackduck workspace/report-portal workspace/feedback workspace/azure-sites labels Jul 3, 2026

backstage-service force-pushed the renovate/npm-backstage-plugin-auth-backend-vulnerability branch from 850ff3d to 7e88bc1 Compare July 3, 2026 18:35

backstage-goalie Bot force-pushed the renovate/npm-backstage-plugin-auth-backend-vulnerability branch from 7e88bc1 to 0da10c5 Compare July 3, 2026 19:35

Copilot AI review requested due to automatic review settings July 3, 2026 19:35

Copilot AI reviewed Jul 3, 2026

backstage-service force-pushed the renovate/npm-backstage-plugin-auth-backend-vulnerability branch from 0da10c5 to 2d641f7 Compare July 3, 2026 19:36

backstage-goalie Bot force-pushed the renovate/npm-backstage-plugin-auth-backend-vulnerability branch from 2d641f7 to 969b124 Compare July 3, 2026 20:32

Copilot AI review requested due to automatic review settings July 3, 2026 20:32

Copilot AI reviewed Jul 3, 2026

backstage-service force-pushed the renovate/npm-backstage-plugin-auth-backend-vulnerability branch from 969b124 to 60e39b0 Compare July 3, 2026 20:33

Copilot AI review requested due to automatic review settings July 3, 2026 21:33

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Comment thread workspaces/report-portal/.changeset/renovate-3520e91.md

@@ -0,0 +1,5 @@

---

'@backstage-community/plugin-report-portal-backend': patch

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Comment thread workspaces/report-portal/packages/backend/package.json

"@backstage/config": "^1.3.3",

"@backstage/plugin-app-backend": "^0.5.4",

"@backstage/plugin-auth-backend": "^0.25.2",

"@backstage/plugin-auth-backend": "^0.27.0",

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Comment thread workspaces/report-portal/plugins/report-portal-backend/package.json

@@ -47,7 +47,7 @@

"@backstage/backend-defaults": "^0.11.1",

"@backstage/backend-test-utils": "^1.7.0",

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Comment thread workspaces/report-portal/packages/backend/package.json

"@backstage/plugin-auth-backend": "^0.25.2",

"@backstage/plugin-auth-backend": "^0.27.0",

"@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",

"@backstage/plugin-auth-node": "^0.6.5",

Copilot AI reviewed Jul 18, 2026

View reviewed changes

fix(deps): update dependency @backstage/plugin-auth-backend to v0.27.…

1da3e82

…1 [security] Signed-off-by: Renovate Bot <bot@renovateapp.com>

Copilot AI reviewed Jul 18, 2026

View reviewed changes

		@@ -0,0 +1,5 @@
		---
		'@backstage-community/plugin-report-portal-backend': patch

		@@ -47,7 +47,7 @@
		"@backstage/backend-defaults": "^0.11.1",
		"@backstage/backend-test-utils": "^1.7.0",

Uh oh!

Conversation

backstage-goalie Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

Details

Impact

Patches

Workarounds

References

Severity

References

@​backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

backstage-goalie Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changed Packages

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

backstage-goalie Bot commented Jul 3, 2026 •

edited

Loading

@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

backstage-goalie Bot commented Jul 3, 2026 •

edited

Loading