---
id: "CVE-2026-115360"
kind: "vulnerability"
aliases: ["CVE-2026-115360"]
title: "OpenBao: UI OIDC login open redirect sends users to attacker sites"
severity: "medium"
cvss: 5.3
epss: 0.00203
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "oidc", "openbao", "self-hosted"]
not_affected_if: ["api-only-use", "oidc-disabled"]
published_at: "2026-10-22T19:17:42+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:19:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115360", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115360", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenBao: UI OIDC login open redirect sends users to attacker sites

OpenBao before 2.6.3 has an open redirect in the UI's OIDC identity provider flow. An attacker can craft a link that sends an unauthenticated user to an attacker-controlled site, enabling phishing or credential theft.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenBao version with `bao version`; versions below `2.6.3` are affected.
- Check whether the web UI with OIDC login is exposed to users who are not yet authenticated.

## Fix

- Upgrade OpenBao to `2.6.3` or later.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115360
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115360

## From the sources

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_