Backstage suffers a flaw in its experimental OAuth infrastructure which allows an attacker to bypass redirect‑URI allowlist checks. By setting wildcard hostnames or omitting protocols in the allowlist, an attacker can supply a redirect URI that contains a trusted hostname suffix or an unintended protocol. The system then strips user information and accepts the URI, handing the OAuth authorization code to the attacker after the victim completes the flow. The weakness maps to CWE-601 and CWE-1289.

Any installation of Backstage that has enabled experimental dynamic client registration or client‑ID metadata documents and uses custom wildcard-hostname or protocol‑less redirect URI patterns is vulnerable. Versions before 0.29.2 are affected when these features are active. The functionality remains disabled by default, so only deployments that purposely enabled it are at risk.

The CVSS score is 4.7, indicating a moderate severity. The EPSS score is <1%, indicating a very low probability of exploitation, and the issue is not listed in the KEV catalog. Based on the description, it is inferred that the flaw could be triggered by unauthenticated requests to the OAuth service and depends on configuration choices. The likely attack vector involves an attacker crafting a malicious redirect URI during the OAuth flow to obtain an authorization code, potentially creating or hijacking accounts. The exploitation is realistically remote and does not require privileged access.