Junglewise Threat Intelligence

CVE-2026-33757: OpenBao session fixation via OIDC direct callback mode

CVE-2026-33757 · Severity: critical · CVSS 9.6 · Published 2026-03-27

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Executive brief

OpenBao is an open-source tool used by organizations to manage and protect sensitive information like passwords and encryption keys. A security flaw in its login process allows an attacker to trick a user into unintentionally authorizing a login session for the attacker. If successful, the attacker could gain full access to the victim's secrets and credentials, potentially leading to a total compromise of sensitive corporate data.

Technical details

A session fixation vulnerability exists in OpenBao's JWT/OIDC authentication backend when a role is configured with `callback_mode` set to `direct`. The implementation lacks a manual confirmation step, allowing an attacker to initiate an authentication request and lure a victim to the verification URL. Because the `direct` mode communicates back to the API without user intervention, the attacker can poll the API until a token is issued to their own session upon the victim's successful authentication. This is a violation of the security considerations in RFC 8628 (OAuth 2.0 Device Authorization Grant). The vulnerability is resolved in version 2.5.2 by introducing a mandatory confirmation screen.

Affected products

  • OpenBao OpenBao < 2.5.2

Timeline

  • 2026-03-25: patched: Fix committed to repository
  • 2026-03-27: disclosed: Initial advisory published

References

Related threats