ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-73563

Linux Foundationのbackstage/plugin-auth-backendにおけるオープンリダイレクトの脆弱性

Published Aug 13, 2026 · catalog updated Aug 13, 2026 · Linux Foundationのbackstage/plugin-auth-backendにおけるオープンリダイレクトの脆弱性

Check if you run it

No confirmed exploitation is on record for CVE-2026-73563. EPSS is 0.17%. Act only if a listed version of Linux Foundationのbackstage/plugin-auth-backendにおけるオープンリダイレクトの脆弱性 is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Linux Foundationのbackstage/plugin-auth-backendにおけるオープンリダイレクトの脆弱性).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.17%
Remediation
Advisory link
Affected products
vendor backstage backstage

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor backstage backstageversion unspecified

How to fix CVE-2026-73563

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-73563. EPSS is 0.17%. Act only if a listed version of Linux Foundationのbackstage/plugin-auth-backendにおけるオープンリダイレクトの脆弱性 is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-601: URL Redirection to Untrusted Site (Open Redirect). EPSS 0.17%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 13, 2026 · CVE.org

    Updated

    Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns a

  2. Oct 16, 2026 · JVN iPedia

    Detected

    Backstageは開発者ポータルを構築するためのオープンフレームワークです。バージョン0.29.2以前では、@backstage/plugin-auth-backendの実験的な動的クライアント登録機能およびクライアントIDメタデータドキュメント機能において、auth.experimentalDynamicClientRegistration.allowedRedirectUriPatternsおよびauth.experimentalClientIdMetadataDocumentsのallowedClientIdPatternsとallowedRedirectUriPatternsオプションで、full-string matcher.isMatchのグロブマッチングが使われていました。ホスト名のワイルドカードはURLコンポーネントの境界を超えてマッチできるため、攻撃者が制御するリダイレ

Sources

  • CVE.orgVulnerability recordCVE-2026-73563

    Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicCl

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-73563

    30-day exploitation probability 0.2%

    first.org
  • JVN iPediaGovernment advisoryCVE-2026-73563

    Backstageは開発者ポータルを構築するためのオープンフレームワークです。バージョン0.29.2以前では、@backstage/plugin-auth-backendの実験的な動的クライアント登録機能およびクライアントIDメタデータドキュメント機能において、auth.experimentalDynamicClientRegistration.allowedRedirectUriPatternsおよびauth.experimentalClientIdMetadataDocumentsのallowedClientIdPatternsとallowedRed

    jvndb.jvn.jp

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.