Gianklug

**Name of the Vulnerable Software and Affected Versions** OpenBao versions prior to 2.5.2 **Description** A flaw in the JWT/OIDC authentication method occurs when a role is configured with the `callback mode` variable set to `direct`. In this configuration, the system fails to prompt for user confirmation during login. An attacker can initiate an authentication request and perform a remote phishing attack by tricking an authenticated user into visiting a crafted URL, which automatically logs the user into the attacker's session. Although based on the authorization code flow, the `direct` mode calls back directly to the API, allowing an attacker to poll for an OpenBao token until it is issued. **Recommendations** Update to version 2.5.2. Remove any roles configured with `callback mode=direct`. Enforce confirmation for every session on the token issuer side for the Client ID used by OpenBao.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions prior to 2.5.2 **Description** OpenBao, an open source identity-based secrets management system, is susceptible to Reflected Cross-Site Scripting (XSS) through the `error description` parameter during failed authentication attempts when an OIDC/JWT authentication method is enabled and a role is configured with `callback mode=direct`. This allows an attacker to gain access to the token used in the Web UI by a victim. The issue is addressed by replacing the `error description` parameter with a static error message. The API endpoint involved in the vulnerability is not explicitly mentioned. The vulnerable parameter is `error description`. **Recommendations** Versions prior to 2.5.2 should be updated to version 2.5.2 or later. As a mitigation, remove any roles with `callback mode` set to `direct`.