OpenBao has Reflected XSS in its OIDC authentication error message (CVE-2026-33758)

OpenBao, an open source identity-based secrets management system, has a reflected XSS vulnerability (CVE-2026-33758) in its OIDC authentication error message prior to version 2.5.2. When OIDC/JWT authentication is enabled and a role is configured with callback_mode=direct, an attacker can exploit the error_description parameter on the failed authentication page to execute arbitrary scripts. This can lead to theft of the victim's authentication token used in the Web UI, potentially exposing database credentials, API keys, or certificates accessible to the user. The vulnerability is mitigated by removing roles with callback_mode=direct or upgrading to version 2.5.2 where the parameter is replaced with a static message.

An attacker who convinces a user to visit a crafted URL can exploit this reflected XSS vulnerability to steal the victim's authentication token used in the OpenBao Web UI. With this token, the attacker can gain full access to secrets the user is authorized to view, including database credentials, API keys, and certificates. The attacker may also modify or revoke tokens and rotate application secrets. The vulnerability requires user interaction and is limited to installations with specific configurations (OIDC/JWT enabled and callback_mode=direct roles).

A fix is available in OpenBao version 2.5.2, which replaces the vulnerable error_description parameter with a static error message. Users should upgrade to version 2.5.2 or later. As an immediate mitigation, review and remove or disable any roles configured with callback_mode=direct in the OIDC/JWT authentication settings. No other actions are required if these mitigations are applied.