{"id":"CVE-2026-126310","kind":"vulnerability","aliases":["CVE-2026-126310"],"related":[],"title":"OpenBao: unauthenticated callers can obtain OIDC ID tokens via public clients","description":"OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.","summary":"OpenBao before 2.6.5 and 2.7.2 lets anyone who knows a public OIDC client's client_id request ID tokens from the identity/oidc/provider token endpoint without a secret. An attacker can impersonate that client and obtain identity tokens they are not entitled to.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenBao","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","oidc","openbao","self-hosted"],"not_affected_if":["no-public-clients","oidc-provider-unused"],"how_to_check":"- Check the OpenBao version with `bao version`; versions below `2.6.5` or `2.7.2` on their respective branches are affected.\n- Look for OIDC providers with public clients that have client_credentials grant enabled.","fix":"- Upgrade OpenBao to `2.6.5` (2.6 branch) or `2.7.2` (2.7 branch).","status":"open","published_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:50:23+00:00","updated_at":"2026-11-13T10:50:23+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:50:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenBao to `2.6.5` (2.6 branch) or `2.7.2` (2.7 branch).","reach":"network","title":"OpenBao: unauthenticated callers can obtain OIDC ID tokens via public clients","impact":"high","summary":"OpenBao before 2.6.5 and 2.7.2 lets anyone who knows a public OIDC client's client_id request ID tokens from the identity/oidc/provider token endpoint without a secret. An attacker can impersonate that client and obtain identity tokens they are not entitled to.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openbao","self-hosted","oidc"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker impersonates an OIDC client and obtains identity tokens","analyst_note":"Confirm the affected configuration conditions and the exact fixed versions in the GitHub vendor advisory linked from the NVD entry.","how_to_check":"- Check the OpenBao version with `bao version`; versions below `2.6.5` or `2.7.2` on their respective branches are affected.\n- Look for OIDC providers with public clients that have client_credentials grant enabled.","plain_action":"","product_name":"OpenBao","needs_analyst":true,"not_affected_if":["oidc-provider-unused","no-public-clients"],"who_is_affected":"Teams running OpenBao with the OIDC identity provider enabled and at least one public client configured with client_credentials. Deployments without the OIDC provider, or where every client is confidential, are less exposed. The sources do not detail further configuration conditions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4628,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126310':14A,17A '-2026':13A,16A '/token':108C '2.6.5':27B,68C '2.7.2':29B,70C 'abus':86C 'allow':77C 'anyon':31B 'attack':53B,93C 'authent':73C 'bypass':74C 'caller':3A,79C 'client':11A,37B,39B,57B,88C,90C,98C,100C,113C 'contain':71C 'credenti':91C 'cve':12A,15A 'enabl':92C 'endpoint':48B,109C 'entitl':65B 'host':24B 'id':7A,40B,42B,83C,101C 'ident':60B 'identity/oidc/provider':46B,107C 'imperson':55B,111C 'infrastructur':19B 'know':33B,95C 'let':30B 'obtain':5A,59B,81C 'oidc':6A,20B,36B,82C 'openbao':1A,18A,21B,25B,66C 'public':10A,35B,87C,97C 'request':41B,103C 'secret':51B,116C 'self':23B 'self-host':22B 'token':8A,43B,47B,61B,84C,104C 'unauthent':2A,78C 'via':9A 'vulner':75C 'without':49B,114C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenBao with the OIDC identity provider enabled and at least one public client configured with client_credentials. Deployments without the OIDC provider, or where every client is confidential, are less exposed. The sources do not detail further configuration conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openbao"],"ptokens":["openbao"],"labels":["high","infrastructure","oidc","openbao","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126310':14A,17A '-2026':13A,16A 'caller':3A 'client':11A 'cve':12A,15A 'id':7A 'obtain':5A 'oidc':6A 'openbao':1A,18A 'public':10A 'token':8A 'unauthent':2A 'via':9A","search_b":"'2.6.5':27B '2.7.2':29B 'anyon':31B 'attack':53B 'client':37B,39B,57B 'endpoint':48B 'entitl':65B 'host':24B 'id':40B,42B 'ident':60B 'identity/oidc/provider':46B 'imperson':55B 'infrastructur':19B 'know':33B 'let':30B 'obtain':59B 'oidc':20B,36B 'openbao':21B,25B 'public':35B 'request':41B 'secret':51B 'self':23B 'self-host':22B 'token':43B,47B,61B 'without':49B","search_c":"'/token':108C '2.6.5':68C '2.7.2':70C 'abus':86C 'allow':77C 'attack':93C 'authent':73C 'bypass':74C 'caller':79C 'client':88C,90C,98C,100C,113C 'contain':71C 'credenti':91C 'enabl':92C 'endpoint':109C 'id':83C,101C 'identity/oidc/provider':107C 'imperson':111C 'know':95C 'obtain':81C 'oidc':82C 'openbao':66C 'public':87C,97C 'request':103C 'secret':116C 'token':84C,104C 'unauthent':78C 'vulner':75C 'without':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T22:08:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126310","severity":null,"published_at":"2026-11-13T10:17:36+00:00","modified_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144951,"url":"https://github.com/openbao/openbao/security/advisories/GHSA-q824-44ff-f5j5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T22:08:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144952,"url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-oidc-provider-authentication-bypass-via-client-credentials","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}