CVE-2026-33758

The vulnerability results from insufficient validation and encoding of the `error_description` parameter displayed on the failed authentication error page (CWE-20, CWE-116). An attacker can craft a malicious URL containing a script in this parameter and trick the victim into visiting it (requires user interaction). When the injected script is executed in the victim's browser, it becomes possible to read the token used in the OpenBao Web UI. In version 2.5.2, the `error_description` parameter was replaced with a static error message, eliminating the attack vector.

An attacker can obtain the Web UI session token of a logged-in user, leading to unauthorized access to the OpenBao secrets management system with the victim's privileges, and potentially also compromising the integrity and availability of dependent systems.

Update OpenBao to version 2.5.2 or later. As a temporary workaround (without updating), you can remove all roles that have `callback_mode=direct` configured in the OIDC/JWT authentication method configuration.

OpenBao in all versions before 2.5.2, when the OIDC/JWT authentication method is enabled and at least one role is configured with the `callback_mode=direct` parameter.