Gianklug

The UI's OIDC identity provider allows unauthenticated users to be redirected to external, attacker-controlled destinations via specially crafted OIDC links. This issue can be leveraged to facilitate phishing attacks or the theft of user credentials.

A flaw in the JWT/OIDC authentication method occurs when a role is configured with the `callback mode` variable set to `direct`. In this configuration, the system fails to prompt for user confirmation during login. An attacker can initiate an authentication request and perform a remote phishing attack by tricking an authenticated user into visiting a crafted URL, which automatically logs the user into the attacker's session. Although based on the authorization code flow, the `direct` mode calls back directly to the API, allowing an attacker to poll for an OpenBao token until it is issued.

OpenBao, an open source identity-based secrets management system, is susceptible to Reflected Cross-Site Scripting (XSS) through the `error description` parameter during failed authentication attempts when an OIDC/JWT authentication method is enabled and a role is configured with `callback mode=direct`. This allows an attacker to gain access to the token used in the Web UI by a victim. The issue is addressed by replacing the `error description` parameter with a static error message. The API endpoint involved in the vulnerability is not explicitly mentioned. The vulnerable parameter is `error description`.