CVE-2026-115360 in OpenBao
Summary
by MITRE • 10/23/2026
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw resides within the Open Source HashiCorp Vault fork known as OpenBao, specifically affecting versions prior to 2.6.3. This vulnerability is classified as an open redirect issue located in the user interface component responsible for handling OIDC identity provider interactions. The core technical deficiency lies in the insufficient validation of redirection parameters during the authentication flow initiation phase. When a user attempts to log in via OpenID Connect, the system constructs a URL that includes a callback or post-authentication redirect target. Due to inadequate sanitization of this input parameter, an attacker can manipulate the value to point toward a domain controlled by them rather than the legitimate application endpoint. This flaw specifically impacts users who are not yet authenticated, as they are the ones initiating the login process and thus exposed to the malicious link before any security controls or session validation mechanisms engage.
From an operational perspective, this vulnerability facilitates sophisticated phishing campaigns and credential harvesting attacks. An attacker can craft a deceptive URL that appears legitimate because it originates from the trusted OpenBao domain but ultimately redirects the victim to a spoofed login page hosted on a remote server. Once redirected, the user may be prompted to enter their credentials into the fake interface. If the attacker has also compromised or mimicked the OIDC provider's response handling logic, they could potentially intercept authentication tokens or session cookies. This undermines the integrity of the single sign-on process and compromises the confidentiality of user identities within the OpenBao ecosystem. The impact is particularly severe in enterprise environments where OpenBao serves as a central identity management hub, as compromising one administrative account can lead to broader access violations across connected systems.
In terms of industry standard classifications, this vulnerability aligns with CWE-601, which defines URL Redirection to Untrusted Site (Open Redirect). The attack vector leverages the trust users place in known domains to bypass initial skepticism, a tactic commonly documented under MITRE ATT&CK technique T1583.002, specifically Acquire Infrastructure: Domains. By exploiting this misconfiguration, adversaries can establish credible phishing infrastructure that evades basic domain-based security filters. The lack of strict allow-listing for redirect targets allows the application to act as a trusted proxy for malicious redirections, effectively weaponizing its own authentication flow against its users.
To mitigate this risk, organizations running OpenBao versions earlier than 2.6.3 must immediately upgrade to version 2.6.3 or later where the validation logic has been corrected. The patch ensures that redirect URLs are strictly validated against a predefined list of allowed domains before being processed by the OIDC handler. Administrators should also review their current deployment configurations and ensure that no custom overrides bypass these new security checks. Additionally, implementing strict Content Security Policy headers can help mitigate potential downstream effects if similar vulnerabilities exist in other parts of the application stack. Regular auditing of authentication flows and monitoring for unusual redirect patterns in access logs are recommended practices to detect any attempted exploitation activities while maintaining robust identity governance protocols.