# CVE-2026-33758: OpenBao reflected XSS in OIDC authentication callback

Source: https://junglewise.ai/threats/cve-2026-33758-openbao-reflected-xss-in-oidc-authentication-callback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33758 · Severity: medium · CVSS 6.1 · Published 2026-03-27

OpenBao, an open-source secrets management system, is vulnerable to a security flaw in its web-based login process. If an attacker tricks a user into clicking a malicious link during a failed login attempt, they can execute unauthorized scripts in the user's browser. This could allow the attacker to steal sensitive authentication tokens, potentially gaining full access to the user's managed secrets and the OpenBao system.

Technologies: [github.com/openbao/openbao (Go)](https://junglewise.ai/threats/technologies/github-com-openbao-openbao), [OpenBao](https://junglewise.ai/threats/technologies/openbao). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenBao](https://junglewise.ai/threats/vendors/openbao).

## Quick answers

**Is CVE-2026-33758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33758 being exploited in the wild.

**How severe is CVE-2026-33758?** Medium severity, with a CVSS score of 6.1, published 27 March 2026.

**Which products and versions are affected?** github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260325133417-6e2b2dd84f0e; OpenBao < 2.5.2.

**Is there a fix for CVE-2026-33758?** Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33758 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33758?** Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openbao/openbao (Go): upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later

  ```sh
  go get github.com/openbao/openbao@v0.0.0-20260325133417-6e2b2dd84f0e
  ```


## Technical details

OpenBao is vulnerable to a reflected Cross-Site Scripting (XSS) vulnerability within its OIDC/JWT authentication handler. The flaw exists in the handling of the `error_description` parameter on the failed authentication page when a role is configured with `callback_mode=direct`. Because this parameter was reflected into the HTML template without proper sanitization or encoding, a remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the OpenBao Web UI. This can lead to the theft of the victim's sensitive authentication tokens. The issue is addressed in version 2.5.2 by replacing the dynamic parameter with a static error message and improving output encoding. A temporary mitigation is to disable the `direct` callback mode for all OIDC/JWT roles.

## Affected products

- OpenBao OpenBao < 2.5.2

## Identifiers

- CVE-2026-33758
- GHSA-cpj3-3r2f-xj59
- GO-2026-4862

## Timeline

- 2026-03-25: patched: Fixed in version 2.5.2
- 2026-03-27: advisory: GHSA-cpj3-3r2f-xj59 published

## References

- [https://github.com/openbao/openbao/commit/6e2b2dd84f0e47cebc90d6e79609dd5274732662](https://github.com/openbao/openbao/commit/6e2b2dd84f0e47cebc90d6e79609dd5274732662)
- [https://github.com/openbao/openbao/pull/2709](https://github.com/openbao/openbao/pull/2709)
- [https://github.com/openbao/openbao/releases/tag/v2.5.2](https://github.com/openbao/openbao/releases/tag/v2.5.2)
- [https://github.com/openbao/openbao/security/advisories/GHSA-cpj3-3r2f-xj59](https://github.com/openbao/openbao/security/advisories/GHSA-cpj3-3r2f-xj59)
- [https://access.redhat.com/security/cve/CVE-2026-33758](https://access.redhat.com/security/cve/CVE-2026-33758)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452294](https://bugzilla.redhat.com/show_bug.cgi?id=2452294)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33758.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33758.json)

## Related threats

- [OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect)
- [OpenBao ACL bypass in policy denial evaluation](https://junglewise.ai/threats/cve-2026-115361-openbao-before-2-6-3-contains-an-acl-bypass-vulnerability-that)
- [OpenBao Kubernetes Auth token renewal on revoked credentials](https://junglewise.ai/threats/cve-2026-115356-openbao-before-2-6-4-and-2-7-x-before-2-7-1-does-not-verify-when)
- [OpenBao Agent information disclosure via stdout in exec rendering mode](https://junglewise.ai/threats/cve-2026-77285-openbao-agent-information-disclosure-via-stdout-in-exec-rendering)
- [OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage)