CVE-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-33757?
CVE-2026-33757 is a critical vulnerability in openbao, published on 27 Mar 2026.
Official description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for `direct` type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with `callback_mode=direct` or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
Weakness: CWE-384
Which versions are affected by CVE-2026-33757?
4 open source packages ship an affected version, including github.com/openbao/openbao and openbao. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260325142553-e32103951925 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260325142553-e32103951925 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260325142553-e32103951925 |
openbao Bitnami | All versions | 2.5.2 |
Products include Openbao Openbao.
How do I fix CVE-2026-33757?
Upgrade github.com/openbao/openbao to 0.0.0-20260325142553-e32103951925 or later.
Is CVE-2026-33757 being exploited?
There is no known exploitation of CVE-2026-33757 in the wild and no public exploit code.
Other vulnerabilities in openbao
- CVE-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message
- CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host
- CVE-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
- CVE-2025-59043 OpenBao vulnerable to denial of service via malicious JSON request processing
- CVE-2025-54996 OpenBao Root Namespace Operator May Elevate Token Privileges
Sources
Also known as BIT-openbao-2026-33757, GHSA-7q7g-x6vg-xpc3, GO-2026-4860.