BIT-openbao-2026-115360: OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who are not authenticated to OpenBao are affected when they follow a crafted OIDC identity-provider link. The impact is primarily phishing or credential theft through redirection to an attacker-controlled destination.
What does an attacker need to exploit it?
An attacker needs to craft an OIDC link and persuade an unauthenticated user to interact with it. No attacker authentication or user privileges are required, but user interaction is required.
Which versions should be remediated?
OpenBao versions before 2.6.3 are affected. Upgrade to version 2.6.3 or later.