Live › vulnerability › CVE-2026-115360
Go to dashboardOpenBao before 2.6.3 has an open redirect in the UI's OIDC identity provider flow. An attacker can craft a link that sends an unauthenticated user to an attacker-controlled site, enabling phishing or credential theft.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao before 2.6.3 with the web UI and OIDC identity provider login enabled, where users who are not authenticated reach the login flow. The sources do not say whether OIDC-less or API-only deployments are affected, so treat only UI-with-OIDC setups as the exposed case.
No product ranges from the sources yet.
bao version; versions below 2.6.3 are affected.2.6.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.
This page as .md · .json · in your agent: get_signal("CVE-2026-115360")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.