CVE-2026-126310: OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials
OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with clientcredentials enabled. Attackers who know a public client's clientid can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running OpenBao before 2.6.5 or 2.7.2 are exposed if they have a public OIDC client with client_credentials enabled.
What does an attacker need to exploit this issue?
An attacker needs to know the client_id of an affected public client. No client secret or prior authentication is required.
What can an attacker obtain?
An attacker can request OIDC ID tokens from the identity/oidc/provider/<name>/token endpoint and impersonate the affected client.
What should be done if an upgrade cannot happen immediately?
Disable client_credentials for public OIDC clients until OpenBao can be updated to 2.6.5, 2.7.2, or a later version.