The vulnerability arises from the experimental OIDC provider in @backstage/plugin-auth-backend, which performs insufficient validation of redirect URIs against an allowlist. An attacker can craft a redirect URI that satisfies the allowlist pattern while targeting an attacker-controlled host. When a user authorizes the request, the resulting OAuth authorization code is sent to the attacker, who can then exchange it for a valid access token. This allows the attacker to obtain unauthorized access tokens, potentially compromising the confidentiality and integrity of protected resources. The weakness is identified as CWE-601 (Open Redirect).

Any Backstage instance using @backstage/plugin-auth-backend prior to version 0.27.1 is affected, provided that the experimental Dynamic Client Registration or Client ID Metadata Documents features are enabled and allowedRedirectUriPatterns are configured. The vulnerability is present in all versions below 0.27.1 that include the experimental OIDC provider.

The CVSS score of 5.9 indicates moderate severity. EPSS suggests exploitation probability is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to interact with the OAuth consent flow and the attacker must have an enabled experimental feature. The attack vector is network-based via OAuth, but necessitates user authorization. Because it relies on feature configuration and victim interaction, the overall risk to an unconfigured or unmanaged instance is limited, though impacted deployments should still remediate promptly.