Bug 2452294 (CVE-2026-33758) - CVE-2026-33758 OpenBao: reflected XSS in OpenBao OIDC authentication error message
Summary: CVE-2026-33758 OpenBao: reflected XSS in OpenBao OIDC authentication error me...
Keywords:
Status: NEW
Alias: CVE-2026-33758
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2452356 2452354 2452355
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-27 15:04 UTC by OSIDB Bzimport
Modified: 2026-03-27 17:48 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-27 15:04:02 UTC 
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the  `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.
Note You need to log in before you can comment on or make changes to this bug.