{"cve":"CVE-2021-43776","nvd":{"published":"2021-11-26T19:15:07.843","modified":"2026-06-17T04:11:23.687","status":"Modified","description":"Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49","https://github.com/backstage/backstage/tree/master/plugins/auth-backend","https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49","https://github.com/backstage/backstage/tree/master/plugins/auth-backend"],"products":["linuxfoundation:auth_backend"],"source":"nvd","synced_at":"2026-10-19T21:25:41.256909649+00:00"},"epss":{"cve":"CVE-2021-43776","score":0.00678,"percentile":0.52323,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w7fj-336r-vw49","url":"https://osv.dev/vulnerability/GHSA-w7fj-336r-vw49","summary":"Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend","modified":"2026-05-04T08:46:12.123698814Z","packages":[{"ecosystem":"npm","name":"@backstage/plugin-auth-backend","purl":"pkg:npm/%40backstage/plugin-auth-backend","ranges":["<0.4.9"],"fixed":["0.4.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}