CVE-2026-33757

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with "callbackmode" set to "direct". This allows an attacker to start an authentication request and perform "remote...