Junglewise Threat Intelligence

CVE-2026-33758: OpenBao reflected XSS in OIDC authentication callback

CVE-2026-33758 · Severity: medium · CVSS 6.1 · Published 2026-03-27

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Executive brief

OpenBao, an open-source secrets management system, is vulnerable to a security flaw in its web-based login process. If an attacker tricks a user into clicking a malicious link during a failed login attempt, they can execute unauthorized scripts in the user's browser. This could allow the attacker to steal sensitive authentication tokens, potentially gaining full access to the user's managed secrets and the OpenBao system.

Technical details

OpenBao is vulnerable to a reflected Cross-Site Scripting (XSS) vulnerability within its OIDC/JWT authentication handler. The flaw exists in the handling of the `error_description` parameter on the failed authentication page when a role is configured with `callback_mode=direct`. Because this parameter was reflected into the HTML template without proper sanitization or encoding, a remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the OpenBao Web UI. This can lead to the theft of the victim's sensitive authentication tokens. The issue is addressed in version 2.5.2 by replacing the dynamic parameter with a static error message and improving output encoding. A temporary mitigation is to disable the `direct` callback mode for all OIDC/JWT roles.

Affected products

  • OpenBao OpenBao < 2.5.2

Timeline

  • 2026-03-25: patched: Fixed in version 2.5.2
  • 2026-03-27: advisory: GHSA-cpj3-3r2f-xj59 published

References

Related threats