Loading...
Skip to main content
GeekWala

CVE-2026-33757 — Vulnerability in github.com/openbao/openbao — CVE...

CRITICAL

OpenBao lacks user confirmation for OIDC direct callback mode

Published March 26, 2026Updated July 27, 2026Source: osv

Summary

### Impact OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. ### Patches Version 2.5.2 includes an additional confirmation screen for `direct` type logins that requires manual user interaction in order to finish the authentication. ### Workarounds This issue can be worked around either by removing any roles with `callback_mode=direct` or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.

Advisory Timeline

  • First published March 26, 2026 (200 days ago).
  • Last revised July 27, 2026 — 123 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/openbao/openbao to 0.0.0-20260325142553-e32103951925 or later
go get github.com/openbao/openbao@v0.0.0-20260325142553-e32103951925

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/openbao/openbao
go
All versions0.0.0-20260325142553-e32103951925

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References

Frequently Asked Questions

What is CVE-2026-33757?
OpenBao lacks user confirmation for OIDC direct callback mode This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2026-33757?
CVE-2026-33757 affects github.com/openbao/openbao. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33757 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-7q7g-x6vg-xpc3
BIT-openbao-2026-33757
GO-2026-4860

Related CVEs

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies