PT-2026-121540

CVE-2026-115360

Published

2026-10-22

Updated

2026-10-29

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3

Description The UI's OIDC identity provider allows unauthenticated users to be redirected to external, attacker-controlled destinations via specially crafted OIDC links. This issue can be leveraged to facilitate phishing attacks or the theft of user credentials.

Recommendations Update to version 2.6.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Cipherboy

Gianklug

Seifelsallamy

Vendors

Affected products

Weakness enumeration