01 Record

CVE-2026-73563

Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`

MediumPUBLISHEDCNA: GitHub_M

Base score4.7 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

02 Description

Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`

Published: 2026-08-13 17:32Z1 DAY AGO
Last updated: 2026-08-13 18:07Z1 DAY AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: Medium (CVSS 4.7)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weaknesses: CWE-601
SSVC decision: ExploitationnoneAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 444c63a230da3e2ce294276f64a6018ab8962c3f5e008e1ff8e568cee4dbd1f1

VendorProductVersionsPlatforms

backstagebackstage< 0.29.2—