{"id":"CVE-2026-115360","kind":"vulnerability","aliases":["CVE-2026-115360"],"related":[],"title":"OpenBao: UI OIDC login open redirect sends users to attacker sites","description":"OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.","summary":"OpenBao before 2.6.3 has an open redirect in the UI's OIDC identity provider flow. An attacker can craft a link that sends an unauthenticated user to an attacker-controlled site, enabling phishing or credential theft.","severity":"medium","cvss":5.3,"epss":0.00203,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","oidc","openbao","self-hosted"],"not_affected_if":["api-only-use","oidc-disabled"],"how_to_check":"- Check the OpenBao version with `bao version`; versions below `2.6.3` are affected.\n- Check whether the web UI with OIDC login is exposed to users who are not yet authenticated.","fix":"- Upgrade OpenBao to `2.6.3` or later.","status":"open","published_at":"2026-10-22T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:19:02+00:00","updated_at":"2026-10-25T04:19:02+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T04:19:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenBao to `2.6.3` or later.","reach":"internet","title":"OpenBao: UI OIDC login open redirect sends users to attacker sites","impact":"medium","summary":"OpenBao before 2.6.3 has an open redirect in the UI's OIDC identity provider flow. An attacker can craft a link that sends an unauthenticated user to an attacker-controlled site, enabling phishing or credential theft.","category":"infrastructure","nicknames":[],"who_cares":["openbao","self-hosted","oidc"],"confidence":0.7,"needs_auth":"no","worst_case":"Users are redirected to attacker sites and may give up credentials.","analyst_note":"","how_to_check":"- Check the OpenBao version with `bao version`; versions below `2.6.3` are affected.\n- Check whether the web UI with OIDC login is exposed to users who are not yet authenticated.","needs_analyst":false,"not_affected_if":["api-only-use","oidc-disabled"],"who_is_affected":"Teams running OpenBao before 2.6.3 with the web UI and OIDC identity provider login enabled, where users who are not authenticated reach the login flow. The sources do not say whether OIDC-less or API-only deployments are affected, so treat only UI-with-OIDC setups as the exposed case.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000586,"input_tokens":3364,"output_tokens":499,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115360':14A,17A '-2026':13A,16A '2.6.3':26B,63C 'affect':77C 'attack':10A,40B,53B,83C,94C 'attacker-control':52B,93C 'authent':80C 'contain':64C 'control':54B,95C 'craft':42B,85C 'credenti':59B,100C 'cve':12A,15A 'destin':96C 'enabl':56B,97C 'flow':38B 'host':23B 'ident':36B,74C 'infrastructur':18B 'link':44B,87C 'login':4A 'oidc':3A,19B,35B,73C,86C 'open':5A,29B,66C 'openbao':1A,20B,24B,61C,82C 'phish':57B,98C 'provid':37B,75C 'redirect':6A,30B,67C,89C 'self':22B 'self-host':21B 'send':7A,46B 'site':11A,55B 'theft':60B,101C 'ui':2A,33B,71C 'unauthent':48B,90C 'user':8A,49B,78C,91C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenBao before 2.6.3 with the web UI and OIDC identity provider login enabled, where users who are not authenticated reach the login flow. The sources do not say whether OIDC-less or API-only deployments are affected, so treat only UI-with-OIDC setups as the exposed case.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115360","severity":null,"published_at":"2026-10-22T19:17:42+00:00","modified_at":"2026-10-23T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115360","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115360","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}