CVE-2026-115360

Published: Ott 22, 2026 Last Modified: Ott 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 4,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

601

URL Redirection to Untrusted Site ('Open Redirect')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Other
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Other
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: Low
View CWE Details
https://github.com/openbao/openbao/security/advisories/GHSA…
https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx
https://www.vulncheck.com/advisories/openbao-before-2.6.3-o…
https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oid…