XSS Vulnerability in OpenBao Identity-Based Secrets Management System
CVE-2026-33758

9.4CRITICAL

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
27 March 2026

What is CVE-2026-33758?

OpenBao, an open-source identity-based secrets management system, is susceptible to a Cross-Site Scripting (XSS) exploit affecting installations with OIDC/JWT authentication enabled. The vulnerability occurs when a role is configured with callback_mode=direct, allowing an attacker to inject malicious scripts through the error_description parameter on the failed authentication page. This can lead to unauthorized access to the token utilized in the Web UI by a victim. The issue has been addressed in version 2.5.2, which replaces the vulnerable error_description parameter with a static error message. To mitigate the risk, users are advised to remove any roles utilizing callback_mode=direct.

Affected Version(s)

openbao < 2.5.2

References

https://github.com/openbao/openbao/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/2709
x_refsource_MISC
https://github.com/openbao/openbao/commit/6e2b2dd84f0e47c...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.