CVE-2026-115360: OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-601

Description

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

Affected products

openbao: before 2.6.3 — fixed in 2.6.3

How to fix

Upgrade to a fixed version: openbao 2.6.3. Check the vendor advisory for mitigations.

References

https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx
https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui

Get alerted when CVE-2026-115360 or the next vulnerability affects your stack