diff --git a/.changeset/clean-apples-breathe.md b/.changeset/clean-apples-breathe.md
new file mode 100644
index 0000000000..f946b9496a
--- /dev/null
+++ b/.changeset/clean-apples-breathe.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixes potential bug introduced in `0.4.10` which causes `OAuth2AuthProvider` to authenticate using credentials in both POST payload and headers.
+This might break some stricter OAuth2 implementations so there is now a `basicAuth` config option that can manually be set to `true` to enable this behavior.
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index 1160ad19c9..b7978bcf79 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -59,6 +59,7 @@ export type OAuth2AuthProviderOptions = OAuthProviderOptions & {
   tokenUrl: string;
   scope?: string;
   logger: Logger;
+  basicAuth?: boolean;
 };
 
 export class OAuth2AuthProvider implements OAuthHandlers {
@@ -85,12 +86,14 @@ export class OAuth2AuthProvider implements OAuthHandlers {
         tokenURL: options.tokenUrl,
         passReqToCallback: false as true,
         scope: options.scope,
-        customHeaders: {
-          Authorization: `Basic ${this.encodeClientCredentials(
-            options.clientId,
-            options.clientSecret,
-          )}`,
-        },
+        customHeaders: options.basicAuth
+          ? {
+              Authorization: `Basic ${this.encodeClientCredentials(
+                options.clientId,
+                options.clientSecret,
+              )}`,
+            }
+          : undefined,
       },
       (
         accessToken: any,
@@ -244,6 +247,7 @@ export const createOAuth2Provider = (
       const authorizationUrl = envConfig.getString('authorizationUrl');
       const tokenUrl = envConfig.getString('tokenUrl');
       const scope = envConfig.getOptionalString('scope');
+      const basicAuth = envConfig.getOptionalBoolean('basicAuth');
       const disableRefresh =
         envConfig.getOptionalBoolean('disableRefresh') ?? false;
 
@@ -280,6 +284,7 @@ export const createOAuth2Provider = (
         tokenUrl,
         scope,
         logger,
+        basicAuth,
       });
 
       return OAuthAdapter.fromConfig(globalConfig, provider, {