fix(deps): update dependency @backstage/plugin-auth-backend to v0.27.1 [security]#4404
Merged
openshift-merge-bot[bot] merged 1 commit intomainfrom Mar 25, 2026
Conversation
|
Hi @renovate[bot]. Thanks for your PR. I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
57e76b1 to
7ee1c25
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
7ee1c25 to
dac1c4d
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
dac1c4d to
de50017
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
de50017 to
9f1fd2a
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
9f1fd2a to
d9d516a
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
d9d516a to
9a947af
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
9a947af to
88452e6
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
88452e6 to
0b223f9
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
0b223f9 to
0422f21
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
0422f21 to
ac2854a
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
ac2854a to
1797a14
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
bbf1b78 to
af068f1
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
2 times, most recently
from
4a9256b to
27d7078
Compare
Contributor
|
The container image build workflow finished with status: |
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
27d7078 to
d6b80d7
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
d6b80d7 to
9317a2e
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
9317a2e to
6d3c64a
Compare
Contributor
|
The container image build workflow finished with status: |
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
6d3c64a to
099ea61
Compare
Contributor
|
The container image build workflow finished with status: |
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
099ea61 to
83bc0dd
Compare
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
83bc0dd to
695cf63
Compare
…1 [security] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
bot
force-pushed
the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
from
695cf63 to
fd114f5
Compare
|
Contributor
|
The container image build workflow finished with status: |
Member
|
/ok-to-test |
openshift-merge-bot
bot
deleted the
renovate/npm-backstage-plugin-auth-backend-vulnerability
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.27.0→0.27.1GitHub Vulnerability Alerts
CVE-2026-32235
Impact
The experimental OIDC provider in
@backstage/plugin-auth-backendis vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configuredallowedRedirectUriPatternsare affected.A specially crafted redirect URI can pass the allowlist validation while resolving to an attacker-controlled host. If a victim approves the resulting OAuth consent request, their authorization code is sent to the attacker, who can exchange it for a valid access token.
This requires victim interaction and that one of the experimental features is explicitly enabled, which is not the default.
Patches
Upgrade to
@backstage/plugin-auth-backendversion 0.27.1 or later.Workarounds
Disable experimental Dynamic Client Registration and Client ID Metadata Documents features if they are not required.
References
Release Notes
backstage/backstage (@backstage/plugin-auth-backend)
v0.27.1Compare Source
Patch Changes
d0f4cd2: Added optional client metadata document endpoint at/.well-known/oauth-client/cli.jsonrelative to the auth backend base URL for CLI authentication. Enabled whenauth.experimentalClientIdMetadataDocuments.enabledis set totrue.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.