CVE-2026-115360: OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

Q: Who is exposed to this issue?

Unauthenticated users who follow attacker-crafted OIDC links to the OpenBao UI are exposed. The impact is redirection to an attacker-controlled destination, which can support phishing or credential theft.

Q: What does an attacker need to exploit it?

An attacker needs to craft an OIDC link and persuade an unauthenticated user to open it. No OpenBao authentication or privileges are required by the attacker.

Q: Which versions should be remediated?

OpenBao versions before 2.6.3 are affected. Upgrade to 2.6.3 or later.

Published Oct 22, 2026

Updated

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

Affected Software

1 affected component

OpenBao OpenBao<2.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.3

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Unauthenticated users who follow attacker-crafted OIDC links to the OpenBao UI are exposed. The impact is redirection to an attacker-controlled destination, which can support phishing or credential theft.

What does an attacker need to exploit it?

An attacker needs to craft an OIDC link and persuade an unauthenticated user to open it. No OpenBao authentication or privileges are required by the attacker.

Which versions should be remediated?

OpenBao versions before 2.6.3 are affected. Upgrade to 2.6.3 or later.

CVE-2026-115360: OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions should be remediated?