CVE-2026-33758 is a medium-severity Cross-Site Scripting (XSS) vulnerability affecting OpenBao versions prior to 2.5.2, specifically when OIDC/JWT authentication is enabled with a role configured for `callback_mode=direct`. An unauthenticated attacker can exploit this flaw via the `error_description` parameter on a failed authentication page, potentially gaining access to a victim's Web UI token. With a CVSS score of 6.1 (Medium), this vulnerability has low attack complexity and can be exploited over the network, though it requires user interaction. There is currently no evidence of active exploitation, nor are public exploit modules available. Organizations are advised to upgrade to OpenBao 2.5.2 or mitigate by removing any roles with `callback_mode` set to `direct`.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5.2CPE matchmatch criteria | cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.