OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the AppRole authentication method where expired Secret IDs are not checked upon use. This flaw allows expired Secret IDs to remain valid until they are removed by a periodic tidy process, potentially enabling unauthorized login beyond the intended time-to-live (TTL).