CVE-2026-73563 is a medium-severity (CVSS 4.7) Open Redirect vulnerability in @backstage/plugin-auth-backend. A fix is available for @backstage/plugin-auth-backend — see the affected versions and patch details below.
Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-73563.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-73563 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 382,795 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@backstage/plugin-auth-backendnpmDescription
Impact
The allowlist matching used by the experimental dynamic client registration and client ID metadata document (CIMD) features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A * wildcard could therefore match across URL component boundaries: a pattern such as https://*.example.com/callback, intended to allow subdomains of a trusted host, would also match an attacker-controlled URL such as https://attacker.example/x.example.com/callback. This applies to auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns as well as the allowedClientIdPatterns and allowedRedirectUriPatterns options of auth.experimentalClientIdMetadataDocuments.
An attacker could use this to register an OAuth client whose redirect URI points to a host they control while still passing the allowlist, causing authorization codes to be delivered to the attacker when a victim completes an authorization flow. In addition, allowlist patterns without an explicit protocol could match URLs with any protocol, and redirect URIs containing embedded credentials (user:pass@host) were accepted after the credentials were stripped for matching.
The practical impact is limited. Both features are experimental and disabled by default, and the default allowlist patterns only reference fixed or loopback hosts and are not affected. Deployments are only impacted if they enable one of these features and configure custom allowlist patterns that contain a wildcard in the hostname, or patterns without an explicit protocol.
Patches
Patched in @backstage/plugin-auth-backend version 0.29.2. Patterns are now matched against each URL component separately so that wildcards no longer match across the host and path boundary, patterns without an explicit protocol are rejected as invalid configuration, and redirect URIs with embedded credentials are always rejected.
Note that as part of this fix, a wildcard port no longer implicitly matches every path: a pattern such as http://localhost:* now only matches the root path. Use http://localhost:*/* to allow any port and any path.
Workarounds
Disable the experimental features by removing auth.experimentalDynamicClientRegistration and auth.experimentalClientIdMetadataDocuments from your app-config, which is the default configuration. Alternatively, restrict the configured allowlist patterns to fully specified URLs with an explicit protocol and no wildcard in the hostname, which are not affected by this vulnerability.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @backstage/plugin-auth-backend | all versions | 0.29.2npm install @backstage/plugin-auth-backend@0.29.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @backstage/plugin-auth-backend, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @backstage/plugin-auth-backend to 0.29.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-73563 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat Developer Hub (RHDH) and Ansible Automation Portal ship @backstage/plugin-auth-backend, which contains this vulnerability. However, the affected features (experimental dynamic client registration and client ID metadata documents) are disabled by default. Only deployments that have explicitly enabled these…
Do not enable the experimental dynamic client registration or client ID metadata document features. If these features are currently enabled, review and restrict the allowedRedirectUriPatterns and allowedClientIdPatterns configurations to use fully qualified hostnames with explicit protocols rather than wildcard or protocol-less patterns.Source: Red Hat security advisory for CVE-2026-73563 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Ansible Automation Platform 2.1 | ansible-automation-platform/automation-portal:1788775748 | RHSA-2026:65118 |
| Red Hat Ansible Automation Platform 2.2 | ansible-automation-platform/automation-portal:1788783591 | RHSA-2026:65155 |
Frequently Asked Questions
Is CVE-2026-73563 in your dependencies?
Find it across npm, including transitive dependencies.