{"action":"Upgrade @backstage/plugin-auth-backend to 0.29.2 or later.","affected":[{"fixed":"0.29.2","introduced":"0"}],"component":"@backstage/plugin-auth-backend","cve_ids":["CVE-2026-73563"],"ecosystem":"npm","epss":0.00172,"exploited":false,"fixed_versions":["0.29.2"],"ghsa_id":"GHSA-38hq-7x33-php4","id":"tcs_01M5KEWN2X3N3RPYBM9QBX6MJC","modified_at":"2026-08-13T17:55:56.778079Z","published_at":"2026-07-24T16:20:59Z","references":["https://osv.dev/vulnerability/GHSA-38hq-7x33-php4","https://github.com/backstage/backstage/security/advisories/GHSA-38hq-7x33-php4","https://github.com/backstage/backstage/commit/274acc51d22a7dd919cdda49d9086cf12c0b8711","https://github.com/backstage/backstage/commit/6370e53bce8b227c63092300594ffde29c006886","https://github.com/backstage/backstage/commit/ef606a85545cb6d765e20afd1ff43ae5407a3660","https://github.com/backstage/backstage/commit/fdc0d2dcd9a571e3839d7f5de4133c4e242a3a41","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.53.0"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-38hq-7x33-php4","url":"https://osv.dev/vulnerability/GHSA-38hq-7x33-php4"}],"summary":"@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass"}