CVE-2026-33758 — OpenBao has Reflected XSS in...

CRITICAL

OpenBao has Reflected XSS in its OIDC authentication error message

Published March 26, 2026Updated July 27, 2026Source: osv

Summary

### Impact OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. ### Patches The `error_description` parameter has been replaced with a static error message in v2.5.2 ### Workarounds The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

Advisory Timeline

First published March 26, 2026 (200 days ago).
Last revised July 27, 2026 — 123 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/openbao/openbao to 0.0.0-20260325133417-6e2b2dd84f0e or later

go get github.com/openbao/openbao@v0.0.0-20260325133417-6e2b2dd84f0e

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
github.com/openbao/openbao	go	All versions	0.0.0-20260325133417-6e2b2dd84f0e

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-20
Improper Input ValidationMITRE
CWE-80
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2026-33758?: OpenBao has Reflected XSS in its OIDC authentication error message This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2026-33758?: CVE-2026-33758 affects github.com/openbao/openbao. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33758 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-cpj3-3r2f-xj59

BIT-openbao-2026-33758

GO-2026-4862

Related CVEs

CVE-2026-33757
CRITICAL
OpenBao lacks user confirmation for OIDC direct callback mode
CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2025-54997
CRITICAL
Privileged OpenBao Operator May Execute Code on the Underlying Host

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies