How to fix or mitigate CVE-2026-33758?

Within 24 hours: Inventory all OpenBao deployments and identify instances running versions prior to v2.5.2 with OIDC/JWT authentication enabled and callback_mode=direct configured. Within 7 days: Apply vendor patch by upgrading to OpenBao v2.5.2 or later on all affected systems. Within 30 days: Conduct security audit of Web UI session logs for the past 90 days to detect any unauthorized token usage or anomalous administrative activity.

CVE-2026-33758

Q: What is the CVSS score of CVE-2026-33758?

CVE-2026-33758 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

CRITICAL

Basic XSS (CWE-80)

2026-03-26 https://github.com/openbao/openbao

XSS

9.4

CVSS 4.0 · Vendor: https://github.com/openbao/openbao

Severity by source

Vendor (https://github.com/openbao/openbao) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (https://github.com/openbao/openbao).

CVSS VectorVendor: https://github.com/openbao/openbao

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 18:45 vuln.today

Patch released

Mar 26, 2026 - 18:45 nvd

Patch available

CVE Published

Mar 26, 2026 - 18:37 nvd

CRITICAL 9.4

DescriptionCVE.org

Impact

OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication.

This allows an attacker access to the token used in the Web UI by a victim.

Patches

The error_description parameter has been replaced with a static error message in v2.5.2

Workarounds

The vulnerability can be mitigated by removing any roles with callback_mode set to direct.

AnalysisAI

Cross-site scripting in OpenBao's OIDC/JWT authentication method allows theft of Web UI session tokens when roles are configured with callback_mode=direct. Attackers exploit the unsanitized error_description parameter on failed authentication pages to inject malicious scripts that execute in victims' browsers, granting access to authentication tokens. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft OIDC/JWT authentication request with malicious error_description

Exploit

Victim clicks authentication failure link

Execution

XSS payload executes in victim's browser

Impact

Attacker steals Web UI authentication token

Access

Craft OIDC/JWT authentication request with malicious error_description

Exploit

Victim clicks authentication failure link

Execution

XSS payload executes in victim's browser

Impact

Attacker steals Web UI authentication token

Vulnerability AssessmentAI

Exploitation	OpenBao with OIDC/JWT authentication method enabled and at least one role configured with `callback_mode=direct`. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Authentication requirements not confirmed from available data (CVSS vector not provided). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious URL to the OpenBao Web UI's OIDC authentication callback endpoint, injecting JavaScript into the error_description parameter. The attacker distributes this link via phishing email or social engineering, targeting authenticated OpenBao users. …
Remediation	Upgrade OpenBao to version 2.5.2 or later, which replaces the vulnerable error_description parameter with a static error message (see release notes at https://github.com/openbao/openbao/releases/tag/v2.5.2 and fix commit at https://github.com/openbao/openbao/commit/6e2b2dd84f0e47cebc90d6e79609dd5274732662). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all OpenBao deployments and identify instances running versions prior to v2.5.2 with OIDC/JWT authentication enabled and callback_mode=direct configured. …

Threat intelligence, references, and detailed analysis are available after sign-in.