CVE-2026-115360

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CVSS 3.1

4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)

CWE

CWE-601

Published

2026-10-22

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx
• https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui

Check your stackJSON