EUVD-2026-58177
GHSA-38hq-7x33-php4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Network-reachable via open dynamic client registration (PR:N, AV:N); victim must actively complete OAuth flow (UI:R); authorization code crosses auth server trust boundary to attacker (S:C); only limited confidentiality loss, no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 npm packages depend on @backstage/plugin-auth-backend (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.29.2.
DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2.
AnalysisAI
OAuth authorization code theft in @backstage/plugin-auth-backend prior to 0.29.2 is possible when experimental dynamic client registration or CIMD features are enabled and configured with wildcard-hostname or protocol-less redirect URI allowlist patterns. Full-string glob matching allows a crafted attacker-controlled URI embedding a trusted hostname suffix in its path component to pass the allowlist, delivering authorization codes to the attacker after a victim completes an OAuth flow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target Backstage instance must have explicitly enabled `auth.experimentalDynamicClientRegistration` or `auth.experimentalClientIdMetadataDocuments` in its `app-config` - both are disabled by default and absent from standard configurations; (2) the configured `allowedRedirectUriPatterns` or `allowedClientIdPatterns` must include at least one wildcard-hostname glob pattern (e.g., `https://*.example.com/callback`) or a protocol-less pattern - the default allowlist entries reference only fixed or loopback hosts and are not affected; (3) a victim user must be induced to click a crafted OAuth authorization link and complete the approval flow, delivering the authorization code to the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) accurately reflects the primary constraints: no authentication is required from the attacker (PR:N), but victim interaction is mandatory (UI:R) because an OAuth authorization code is only issued after a user actively approves the authorization request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a Backstage deployment with experimental dynamic client registration enabled submits a registration request for an OAuth client whose redirect URI is `https://attacker.example/trusted.example.com/callback`, which passes the configured `https://*.example.com/callback` allowlist pattern due to full-string glob matching. The attacker then delivers a crafted OAuth authorization link to a victim user; upon the victim completing the authorization flow, Backstage issues the authorization code to the attacker-controlled host, where it can be exchanged for an access token to impersonate the victim. … |
| Remediation | The primary fix is to upgrade `@backstage/plugin-auth-backend` to version 0.29.2, which corrects URL component parsing so that wildcards no longer match across host/path boundaries, rejects patterns lacking an explicit protocol as invalid configuration, and unconditionally blocks redirect URIs containing embedded credentials. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today