OpenBaoGHSA-cpj3-3r2f-xj59

OpenBao has Reflected XSS in its OIDC authentication error message

CVE-2026-33758 · Published Mar 26, 2026 · updated Jul 27, 2026

Critical

Fix: upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later

Impact

OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication.

This allows an attacker access to the token used in the Web UI by a victim.

Patches

The error_description parameter has been replaced with a static error message in v2.5.2

Workarounds

The vulnerability can be mitigated by removing any roles with callback_mode set to direct.

Affected versions

Package	Affected	Fixed in
github.com/openbao/openbao Go	< 0.0.0-20260325133417-6e2b2dd84f0e	0.0.0-20260325133417-6e2b2dd84f0e

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20, CWE-80
Also known as: BIT-openbao-2026-33758, CVE-2026-33758, GO-2026-4862

More OpenBao advisories

All OpenBao

LowMay 5

OpenBao's Namespace Deletion May Not Delete Data ProperlyCVE-2026-42186fixed in 0.0.0-20260420173541-6d2e0506e2b4 LowApr 21

OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationCVE-2026-40264fixed in 0.0.0-20260420162526-f58111d2ca54 Medium 4.9Apr 21

OpenBao's SQL Injection in PostgreSQL database secrets engineCVE-2026-39946fixed in 0.0.0-20260420155735-b596b0882620 Low 3.1Apr 21

OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)CVE-2026-39396fixed in 0.0.0-20260420180337-2b2a901aa9f7 Low 3.1Apr 21

OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateCVE-2026-39388fixed in 0.0.0-20260420160924-abe84e1af4c3 Critical 9.6Mar 26

OpenBao lacks user confirmation for OIDC direct callback modeCVE-2026-33757fixed in 0.0.0-20260325142553-e32103951925