Prior to version 0.27.1, the Backstage plugin‑auth‑backend contains a Server‑Side Request Forgery vulnerability that is triggered when the experimental configuration flag `auth.experimentalClientIdMetadataDocuments.enabled` is set to true. During the CIMD metadata fetch, the initial `client_id` hostname is validated against private IP ranges, but the same validation is not reapplied after HTTP redirects, allowing the server to make internal network requests. The attacker cannot read the response body, cannot control request headers or method, and the feature is disabled by default. As a result, the vulnerability is limited to internal network reconnaissance and indirect reachability.

All releases of @backstage/plugin‑auth‑backend before version 0.27.1 are vulnerable when the experimental flag is enabled. Deployments that have the flag disabled—its default state—or that restrict `allowedClientIdPatterns` to trusted domains are not affected. The affected product is part of the open‑source Backstage developer portal framework.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating a low probability of automated exploitation. The practical impact is limited, but exploiting the flaw requires the attacker to enable the experimental flag, which in typical deployments requires administrative configuration changes. Based on the description, it is inferred that an attacker would need such administrative access to modify the configuration and trigger the SSRF path. The risk remains low unless such privileged changes are made, at which point internal network discovery could occur.