Read the docs
TI-2021-19583 Aliases CVE-2021-43776GHSA-w7fj-336r-vw49

XSS vulnerability in @backstage/plugin-auth-backend

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

Why it matters now

EPSS 0.00678 52nd percentileScored 2026-11-07
Fix Fixed backstage (backstage): 0.4.9@backstage/plugin-auth-backend (npm): 0.4.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagebackstagebefore 0.4.90.4.9Patch availableCNA
—@backstage/plugin-auth-backend (npm)before 0.4.90.4.9Patch availableGHSA-w7fj-336r-vw49
  • backstage Vendorbackstage Affected before 0.4.9 Fixed in 0.4.9 Patch available CNA
  • @backstage/plugin-auth-backend (npm) Vendor— Affected before 0.4.9 Fixed in 0.4.9 Patch available GHSA-w7fj-336r-vw49

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:auth_backend:*:*:*:*:*:node.js:*:*before 0.4.9Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:auth_backend:*:*:*:*:*:node.js:*:* Versions before 0.4.9 Vulnerable ·backstage

Remediation

  • Fix · CNA backstage (backstage) Fixed in 0.4.9
  • Fix · GHSA-w7fj-336r-vw49 @backstage/plugin-auth-backend (npm) Fixed in 0.4.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43776
  2. 2026-10-03 Alias added: GHSA-w7fj-336r-vw49

References

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences