CVE-2026-33757 - Vulnerability Analysis

Overview

OpenBao < 2.5.2 contains an authentication bypass caused by lack of user confirmation in JWT/OIDC login with callback_mode set to direct, letting attackers perform remote phishing and token polling, exploit requires victim to visit crafted URL.

Severity & Score

Impact

Attackers can perform remote phishing to log victims into attacker sessions and poll for tokens, leading to unauthorized access.

Mitigation

Update to version 2.5.2 or later.

References

• https://datatracker.ietf.org/doc/html/rfc8628#section-5.4
• https://github.com/openbao/openbao/commit/e32103951925723e9787e33886ab6b6ec20f4964
• https://github.com/openbao/openbao/security/advisories/GHSA-7q7g-x6vg-xpc3

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🔴 CVE-2026-33757 - Critical (9.6) OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to star... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33757/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner