OpenBao versions prior to 2.6.3 contain an open redirect vulnerability in the UI's OIDC identity provider. This flaw allows attackers to craft links that redirect unauthenticated users to malicious destinations, potentially facilitating phishing or credential theft attacks. The vulnerability is fixed in version 2.6.3.