CVE-2026-33758Critical▾ MidnightOpenBao has Reflected XSS in its OIDC authentication error message
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication.
This allows an attacker access to the token used in the Web UI by a victim.
The error_description parameter has been replaced with a static error message in v2.5.2
The vulnerability can be mitigated by removing any roles with callback_mode set to direct.
github.com/openbao/openbao < 0.0.0-20260325133417-6e2b2dd84f0eUpgrade to a patched release:
github.com/openbao/openbao 0.0.0-20260325133417-6e2b2dd84f0eConnected by shared product, vendor, weakness, or advisory.
CVE-2026-45808HighOpenBao is an open source identity-based secrets management system
CVE-2026-46358MediumOpenBao is an open source identity-based secrets management system
CVE-2026-46405Medium· 5.3OpenBao is an open source identity-based secrets management system
CVE-2025-54997Critical· 9.1Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2026-42186LowOpenBao's Namespace Deletion May Not Delete Data Properly
CVE-2025-54996High· 7.2OpenBao Root Namespace Operator May Elevate Token Privileges