GHSA-cpj3-3r2f-xj59

Source

https://github.com/advisories/GHSA-cpj3-3r2f-xj59

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cpj3-3r2f-xj59/GHSA-cpj3-3r2f-xj59.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cpj3-3r2f-xj59

Aliases

Published

2026-03-26T18:37:09Z

Modified

2026-03-27T21:50:17.804720Z

Severity

9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

OpenBao has Reflected XSS in its OIDC authentication error message

Details

Impact

OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication.

This allows an attacker access to the token used in the Web UI by a victim.

Patches

The error_description parameter has been replaced with a static error message in v2.5.2

Workarounds

The vulnerability can be mitigated by removing any roles with callback_mode set to direct.

Database specific

{
    "cwe_ids": [
        "CWE-20",
        "CWE-80"
    ],
    "github_reviewed_at": "2026-03-26T18:37:09Z",
    "nvd_published_at": "2026-03-27T15:16:57Z",
    "severity": "CRITICAL",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20260325133417-6e2b2dd84f0e

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cpj3-3r2f-xj59/GHSA-cpj3-3r2f-xj59.json"