OpenBao Identity-Based Secrets Management System Vulnerability

CVE-2026-33757

What is CVE-2026-33757?

The OpenBao identity management system has a vulnerability that allows attackers to initiate authentication requests without user confirmation when utilizing JWT/OIDC with a 'callback_mode' setting of 'direct'. This flaw enables attackers to craft URLs that, when visited by victims, can log them into the attacker's session without their consent. The vulnerability arises from the design of the 'direct' mode, which returns the token directly to the API without additional user verification steps. To mitigate this risk, it is advised that users upgrade to version 2.5.2, which introduces a necessary confirmation screen for 'direct' logins, or reconfigure their roles by eliminating 'callback_mode=direct'.

References