CVE-2026-115360
MEDIUM4.7CVSS v3
—CVSS v2
—
EPSS (exploit probability)
CWE-601CWE
Description
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.
CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Affected routers (0)
No routers currently mapped to this CVE in our database.