OpenBao CVE-2026-115360

Exploitation requires that the OpenBao UI be enabled - it is NOT activated by default, and the vendor's documented workaround is to set ui = false to explicitly disable it, so default deployments are not exposed. The attacker must craft a malicious OIDC identity-provider link in the UI and get an unauthenticated user to click it (UI:P / passive user interaction), making this a phishing-dependent attack rather than a self-propagating one. No authentication to OpenBao is needed by the victim or attacker (PR:N) since the flaw specifically affects users not authenticated to OpenBao. Limiting factors: the UI must be enabled and reachable, a user must click the crafted link, and impact is limited to browser redirection (no server-side compromise).

This is a medium-severity open redirect (CWE-601) in the OpenBao UI's OIDC identity provider, and the signals consistently point to a moderate, non-emergency priority rather than a critical one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N, score 5.3) reflects a network-reachable, low-complexity, unauthenticated flaw, but one that requires passive user interaction (UI:P) and yields no confidentiality or availability impact and only low integrity impact - the harm is redirection of a victim's browser, not code execution or data disclosure on the server. No EPSS score was provided and the vulnerability is not listed in CISA KEV, so there is no indication of active exploitation. No PoC or exploit reference is present in the input (only vendor/VulnCheck advisories), so no public exploit identified at time of analysis. The vendor.today decision label is 'this_month', not act_now or emergency, aligning with the picture of a real but low-urgency, phishing-enabling issue. A notable mitigating factor explicitly stated by the vendor is that the OpenBao UI is not enabled by default, which further narrows real-world exposure.

An attacker crafts a malicious OIDC link pointing at a victim organization's internet-facing OpenBao UI that, when visited, redirects the unauthenticated user's browser to an attacker-controlled destination. The attacker distributes this link via phishing; because the initial URL belongs to the trusted OpenBao host, the victim is more likely to trust it before being silently redirected to a credential-harvesting page. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim clicking the link (UI:P).