CVE-2026-33757
OpenBao is an open source identity-based secrets management system.
Published Mar 27, 2026 · updated Jul 15, 2026 · openbao openbao
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with set to . This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with set to . This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the
Jul 15, 2026 · NIST NVD
Updated
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with set to . This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the
Affected
- cpe openbao/openbaoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33757
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33757
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with set to . This allows an attacker to start an authentication request and p
nvd.nist.gov