CVE-2026-33757

The attacker initiates a JWT/OIDC authentication request for a role with callback_mode=direct parameter set. Then they convince the victim to visit a specially crafted URL, which automatically completes the login process without any step requiring user interaction. In direct mode, the callback goes directly to the OpenBao API, allowing the attacker to repeatedly poll the API (polling) to obtain the OpenBao token until successful. The attacker thereby intercepts the victim's authentication token without their knowledge.

An attacker can obtain an OpenBao token authenticated as the victim, giving them access to managed secrets and resources with the compromised account's permissions, potentially leading to disclosure of sensitive data and system integrity violations.

OpenBao should be updated to version 2.5.2, which introduces an additional confirmation screen for direct mode logins requiring manual user interaction. As a workaround, all roles with callback_mode=direct can be removed or confirmation of each session can be enforced on the token issuer side for the Client ID used by OpenBao.

OpenBao (openbao/openbao) in all versions before 2.5.2, when roles with callback_mode=direct parameter are configured for JWT/OIDC