Skip to content
OpenAdvisories

Package · npm

@backstage/plugin-auth-backend

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-73563

    Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`

    Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.…

    backstage backstage @backstage/plugin-auth-backend npm
  • Medium 5.9
    CVE-2026-32235

    @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

    Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registra…

    backstage plugin-auth-backend @backstage/plugin-auth-backend npm