CVE-2026-73563

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2.

• CWE-601

• https://github.com/backstage/backstage/security/advisories/GHSA-38hq-7x33-php4

Published

Aug 13, 2026

Last Modified

Aug 13, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73558vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-73559vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-7356Use after free in Navigation in Google Chrome prior to 147.0…8.8
• CVE-2026-73560vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-73561Hub is a Node.js WebSocket server and client with added feat…7.5
• CVE-2026-73562Mongoose is a MongoDB object modeling tool designed to work …6.5
• CVE-2026-73564frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's…8.7
• CVE-2026-73565@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-73566node-tar is a tar archive manipulation library for Node.js. …7.5
• CVE-2026-73567sm-crypto provides JavaScript implementations of the Chinese…9.1
• CVE-2026-73568py-libp2p is the Python implementation of the libp2p network…7.5
• CVE-2026-73569fast-xml-parser allows users to process XML from JS object w…8.7