CVE-2026-33757: OpenBao lacks user confirmation for OIDC direct callback mode
Impact
OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct.
This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the direct mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued.
Patches Version 2.5.2 includes an additional confirmation screen for direct type logins that requires manual user interaction in order to finish the authentication.
Workarounds This issue can be worked around either by removing any roles with callbackmode=direct or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
Other sources
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the direct mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for direct type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with callbackmode=direct or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openbao/openbaoto a version that resolves this vulnerability.Fixed in 0.0.0-20260325142553-e32103951925 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.5.2 - Configuration
Work around the issue by removing any roles that set callback_mode=direct so direct OIDC/JWT callbacks cannot be used for remote phishing.
OpenBao role (OIDC/JWT callback mode) callback_mode = remove any roles with callback_mode=direct - Compensating control
Work around the issue by enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao (i.e., require manual user confirmation before issuing/finishing authentication for that client).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33757?
CVE-2026-33757 is considered to be a high severity vulnerability due to the potential for remote phishing attacks.
How do I fix CVE-2026-33757?
To fix CVE-2026-33757, update OpenBao to version 0.0.0-20260325142553-e32103951925 or later.
What is the main risk associated with CVE-2026-33757?
The main risk associated with CVE-2026-33757 is the unauthorized automatic login of users, which can lead to phishing exploits.
Who is affected by CVE-2026-33757?
CVE-2026-33757 affects users of OpenBao versions below 0.0.0-20260325142553-e32103951925.
What functionality is compromised by CVE-2026-33757?
CVE-2026-33757 compromises user confirmation during login processes when using JWT/OIDC in direct callback mode.