---
title: "CVE-2026-33757: OpenBao lacks user confirmation for OIDC direct callback mode"
url: https://erroneo.us/security/cve/CVE-2026-33757/
description: "CVE-2026-33757 (github.com/openbao/openbao (Go)): OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-03-27
date_modified: 2026-07-15
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-33757"
kev: false
cvss: 9.6
epss: 0.00606
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-33757: OpenBao lacks user confirmation for OIDC direct callback mode

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.6% , percentile 48: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 48% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Only applies if your dependency tree includes github.com/openbao/openbao (Go) < 0.0.0-20260325142553-e32103951925, fixed in 0.0.0-20260325142553-e32103951925 . Check your lockfile, including transitive dependencies.

## What it is

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the direct mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for direct type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with callbackmode=direct or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.

## Affected packages

- Go `github.com/openbao/openbao` < 0.0.0-20260325142553-e32103951925 → fixed: 0.0.0-20260325142553-e32103951925

## Affected products (CVE record)

- openbao openbao: < 2.5.2

## Severity

- GitHub_M CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L`
- redhat-SADP CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.61% probability of exploitation activity in the next 30 days; percentile 48.

## Sources

- [GitHub Advisory GHSA-7q7g-x6vg-xpc3](https://github.com/advisories/GHSA-7q7g-x6vg-xpc3)
- [CVE.org record CVE-2026-33757](https://www.cve.org/CVERecord?id=CVE-2026-33757)
- [NVD entry CVE-2026-33757](https://nvd.nist.gov/vuln/detail/CVE-2026-33757)
- [github.com](https://github.com/openbao/openbao/security/advisories/GHSA-7q7g-x6vg-xpc3)
- [github.com](https://github.com/openbao/openbao/commit/e32103951925723e9787e33886ab6b6ec20f4964)
- [datatracker.ietf.org](https://datatracker.ietf.org/doc/html/rfc8628#section-5.4)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-33757)
- [RHBZ#2452269](https://bugzilla.redhat.com/show_bug.cgi?id=2452269)
- [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33757.json)

---
Source page: https://erroneo.us/security/cve/CVE-2026-33757/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt