GitHub Advisoryadvisory · Go

GHSA-cpj3-3r2f-xj59 OpenBao has Reflected XSS in its OIDC authentication error message

CRITICAL Published 2026-03-26 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-33758
Ecosystem
Go
Packages
github.com/openbao/openbao
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-20, CWE-80
Reviewed
2026-03-26

Affected packages

• Go github.com/openbao/openbao: < 0.0.0-20260325133417-6e2b2dd84f0e → fixed in 0.0.0-20260325133417-6e2b2dd84f0e

Description

Impact OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. Patches The `error_description` parameter has been replaced with a static error message in v2.5.2 Workarounds The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

Related

Alias · CVE (1)

  • CVE-2026-33758 OpenBao is an open source identity-based secrets management system. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References