CVE-2026-73563
1 advisory.
npm/@backstage/plugin-auth-backend CVE-2026-73563: medium 4.7
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
Action: Upgrade @backstage/plugin-auth-backend to 0.29.2 or later.
npm i @backstage/plugin-auth-backend@0.29.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.29.2 | - |
Fixed versions
| 0.29.2 |
Sources
- osv: GHSA-38hq-7x33-php4
- https://github.com/backstage/backstage/security/advisories/GHSA-38hq-7x33-php4
- https://github.com/backstage/backstage/commit/274acc51d22a7dd919cdda49d9086cf12c0b8711
- https://github.com/backstage/backstage/commit/6370e53bce8b227c63092300594ffde29c006886
- https://github.com/backstage/backstage/commit/ef606a85545cb6d765e20afd1ff43ae5407a3660
- https://github.com/backstage/backstage/commit/fdc0d2dcd9a571e3839d7f5de4133c4e242a3a41
- https://github.com/backstage/backstage
- https://github.com/backstage/backstage/releases/tag/v1.53.0
CVE-2026-73563 · published · modified · JSON