---
id: CVE-2026-115360
title: OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
summary: >-
  OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC
  identity provider that affects users not authenticated to OpenBao. Attackers
  can craft OIDC links that redirect unauthenticated users to
  attacker-controlled de…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-601
vendor: openbao
product: openbao
affected:
  - openbao < 2.6.3
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:35.435Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115360'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx'
    label: GitHub Security Advisory (GHSA-2cjw-94fw-wqjx)
  - url: >-
      https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui
    label: >-
      VulnCheck Advisory: OpenBao before 2.6.3 Open Redirect via OIDC Identity
      Provider UI
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.398Z'
---

## Overview

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

## Affected

- `openbao < 2.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.