CVE-2026-33758 — Improper Input Validation in Openbao Openbao

CWE-20 — Improper Input ValidationCWE-79 — Cross-site ScriptingCWE-116 — Improper Encoding or Escaping of OutputCWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)6 documents5 sources
Severity
9.4CRITICALNVD
EPSS
0.1%
top 68.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Openbao OpenbaoOpenbao
Timeline
PublishedMar 27

Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerabilit…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages2 packages

▶NVDopenbao/openbao< 2.5.2
▶Gogithub.com/openbao_openbao< 0.0.0-20260325133417-6e2b2dd84f0e

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
OpenBao has Reflected XSS in its OIDC authentication error message↗2026-03-26
▶
GHSA
OpenBao has Reflected XSS in its OIDC authentication error message↗2026-03-26
▶
OSV
OpenBao has Reflected XSS in its OIDC authentication error message in github.com/openbao/openbao↗2026-03-26
▶

📋Vendor Advisories

1
Red Hat
OpenBao: reflected XSS in OpenBao OIDC authentication error message↗2026-03-27
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33758 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶