CVE-2026-115360

MEDIUM 4.7

OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

CWE	CWE-601
Vendor	openbao
Product	openbao
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for openbao openbao

Be the first to know when new medium vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

openbao / openbao

0 < 2.6.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx vulncheck.com: https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui

Credits

🔍 gianklug 🔍 SeifElsallamy cipherboy