Description

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-13T18:18:18.803Z",
  "pubdate": "2026-08-13T18:18:18.803Z",
  "executiveSummary": "A glob matching logic vulnerability exists in the @backstage/plugin-auth-backend package of Backstage prior to version 0.29.2, specifically impacting the experimental dynamic client registration and client ID metadata document features.\nThe vulnerability stems from the use of full-string matcher.isMatch glob matching for configuration options including auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns, auth.experimentalClientIdMetadataDocuments.allowedClientIdPatterns, and allowedRedirectUriPatterns.\nThis flaw allows a hostname wildcard to match across URL component boundaries, enabling an attacker-controlled redirect URI that contains a trusted hostname suffix within its path to successfully bypass the configured allowlist validation.\nConsequently, an unsuspecting victim completing the OAuth authorization flow can have their authorization code transmitted to the attacker-controlled endpoint.\nAdditional attack vectors involve patterns lacking explicit protocols matching unintended protocols, and redirect URIs containing embedded credentials being accepted after user information is stripped for matching.\nThe affected features are experimental and disabled by default, meaning only deployments that explicitly enable them and configure custom wildcard-hostname or protocol-less patterns are vulnerable.\nAttackers require the ability to craft malicious redirect URIs or client ID metadata documents matching the flawed glob patterns to execute the exploit.",
  "technicalDetails": "The root cause of the vulnerability resides in the implementation of the full-string matcher.isMatch function utilized by the @backstage/plugin-auth-backend plugin for validating redirect URIs and client IDs against specified patterns.\nBecause hostname wildcards improperly match across URL component boundaries, an attacker can supply a specially crafted redirect URI containing a trusted hostname suffix positioned inside the URI path.\nThis crafted URI satisfies the lenient glob pattern evaluation, tricking the validation mechanism into treating an untrusted destination as a trusted domain.\nFurthermore, patterns configured without an explicit protocol designation are capable of matching unintended protocols, expanding the attack surface.\nAdditionally, the validation logic accepts redirect URIs containing embedded credentials after stripping user information for matching, which further degrades the integrity of the parsing and verification pipeline.\nThe step-by-step attack flow begins with an administrator enabling the experimental dynamic client registration or client ID metadata document features and applying custom wildcard-hostname or protocol-less patterns.\nAn attacker crafts a malicious OAuth redirect URI that exploits the boundary-crossing hostname wildcard or utilizes an unintended protocol.\nA victim initiates and completes the authentication flow within the Backstage developer portal.\nThe vulnerable backend component evaluates the attacker's malicious redirect URI against the flawed allowlist, improperly validates it as a trusted URI due to the boundary-crossing glob match, and issues an OAuth authorization code to the attacker's endpoint.\nThe affected component is @backstage/plugin-auth-backend in versions prior to 0.29.2.\nThe vulnerability affects deployments exposing the authentication backend over the network where experimental features are active, requiring no initial authentication or elevated privileges for the attacker if the dynamic registration or metadata document ingestion is accessible."
}