Open-source package vulnerability · Go

CVE-2026-33758: OpenBao has Reflected XSS in its OIDC authentication error message

criticalCVSS 4.0 9.4GHSA-cpj3-3r2f-xj59

Impact OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim.

Published Mar 26, 2026 · Updated Mar 27, 2026

Affected packages

github.com/openbao/openbao

Ecosystem: Go
Affected: < 0.0.0-20260325133417-6e2b2dd84f0e
Fixed in: 0.0.0-20260325133417-6e2b2dd84f0e
Check: go list -m github.com/openbao/openbao

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication.

This allows an attacker access to the token used in the Web UI by a victim.

Patches

The error_description parameter has been replaced with a static error message in v2.5.2

Workarounds

The vulnerability can be mitigated by removing any roles with callback_mode set to direct.

Credited to gianklug.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries