CVE-2026-33757

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.2

Description A flaw in the JWT/OIDC authentication method occurs when a role is configured with the callback mode variable set to direct. In this configuration, the system fails to prompt for user confirmation during login. An attacker can initiate an authentication request and perform a remote phishing attack by tricking an authenticated user into visiting a crafted URL, which automatically logs the user into the attacker's session. Although based on the authorization code flow, the direct mode calls back directly to the API, allowing an attacker to poll for an OpenBao token until it is issued.

Recommendations Update to version 2.5.2. Remove any roles configured with callback mode=direct. Enforce confirmation for every session on the token issuer side for the Client ID used by OpenBao.