CVE-2021-43776

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

• CWE-79

• https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49Third Party Advisory
• https://github.com/backstage/backstage/tree/master/plugins/auth-backendProduct, Third Party Advisory
• https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49Third Party Advisory
• https://github.com/backstage/backstage/tree/master/plugins/auth-backendProduct, Third Party Advisory

Published

Nov 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43768In Malwarebytes For Teams v.1.0.990 and before and fixed in …5.3
• CVE-2021-4377The Doneren met Mollie plugin for WordPress is vulnerable to…6.5
• CVE-2021-43771Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnera…7.8
• CVE-2021-43772Trend Micro Security 2021 v17.0 (Consumer) contains a vulner…5.5
• CVE-2021-43774A risky-algorithm issue was discovered on Fujifilm DocuCentr…4.9
• CVE-2021-43775Aim is an open-source, self-hosted machine learning experime…8.6
• CVE-2021-43777Redash is a package for data visualization and sharing. In R…6.1
• CVE-2021-43778Barcode is a GLPI plugin for printing barcodes and QR codes.…7.5
• CVE-2021-43779GLPI is an open source IT Asset Management, issue tracking s…9.9
• CVE-2021-4378The WP Quick FrontEnd Editor plugin for WordPress is vulnera…5.4
• CVE-2021-43780Redash is a package for data visualization and sharing. In v…8.8
• CVE-2021-43781Invenio-Drafts-Resources is a submission/deposit module for …4.3