CVE-2026-33758
Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.
How to fix
- openbao openbao2.5.2 or later
- github.com/openbao/openbao0.0.0-20260325133417-6e2b2dd84f0e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbao openbao | v < 2.5.2 | 2.5.2 |
| github.com/openbao/openbaoGo | v < 0.0.0-20260325133417-6e2b2dd84f0e | 0.0.0-20260325133417-6e2b2dd84f0e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.