Backstage @backstage/plugin-auth-backend OAuth redirect_uri Allowlist Bypass via Dynamic Client Registration (CVE-2026-7263)

Vulnerability Overview Title: Unauthenticated OAuth account takeover via allowlist bypass in Description: This vulnerability involves the OAuth client registration and Client ID Metadata Documents (CIDM) features in . These features utilize experimental dynamic client registration and Client ID Metadata Documents, allowing for a bypass of the allowlist, which leads to unauthenticated OAuth account takeover. Affected Versions Affected Versions: Fixed Version: CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None CVSS Score: 4.7 / 10 CVE ID: CVE-2026-7263 Remediation 1. Patch: - In version , pattern matching is now performed separately for each URL component, so wildcards no longer match across host and path boundaries. Allowlist patterns without an explicit protocol are rejected as invalid configurations, and redirect URIs containing embedded credentials are always rejected. - Note: As part of this fix, wildcard ports no longer implicitly match any path; for example, now only matches the root path. Use to allow any port and any path. 2. Workaround: - Disable the experimental features by removing and from (this is the default configuration). - Alternatively, restrict the configured allowlist patterns to fully qualified URLs with an explicit protocol and no wildcards in the hostname, which are not affected by this vulnerability. References OAuth 2.0 Security Best Current Practice (RFC 9700), Section 4.1: https://www.rfc-editor.org/rfc/rfc9700#section-4.1 OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591): https://www.rfc-editor.org/rfc/rfc7591 Code Block No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Backstage @backstage/plugin-auth-backend OAuth redirect_uri Allowlist Bypass via Dynamic Client Registration (CVE-2026-7263)

More from this source