CVE-2026-33757: 
NixOS vulnerability analysis and mitigation

CVE-2026-33757 is a session fixation vulnerability in OpenBao, an open-source identity-based secrets management system, where the application fails to prompt for user confirmation during JWT/OIDC login when a role has callback_mode set to direct. This omission enables "remote phishing" attacks in which an attacker initiates an authentication request and tricks a victim into visiting a crafted URL, automatically logging the victim into the attacker's session. All OpenBao versions prior to 2.5.2 are affected. The vulnerability was published on March 25, 2026, and carries a CVSS v3.1 score of 9.6 (Critical) per the GitHub Security Advisory (GitHub Advisory, OpenBao Advisory).

The root cause is classified as CWE-384 (Session Fixation): OpenBao's direct callback mode in the JWT/OIDC authentication plugin calls back directly to the API without requiring any explicit user confirmation before issuing a token (GitHub Advisory). Although the flow is based on the OAuth 2.0 authorization code grant, the direct mode bypasses the typical browser redirect to a client application, instead allowing the attacker to poll the OpenBao API (/v1/auth/jwt/oidc/poll) for the resulting token once the victim completes the identity provider login (OpenBao Advisory). The attack is analogous to the device authorization grant phishing scenario described in RFC 8628 §5.4. The fix (commit e321039) introduces a mandatory HTML confirmation page for direct mode logins that requires explicit user interaction before the authorization code is processed, and adds a new role parameter oidc_disable_confirmation to optionally suppress this step when the OIDC provider itself enforces confirmation (Patch Commit).

Successful exploitation allows an attacker to obtain a valid OpenBao authentication token belonging to the victim's identity without the victim's awareness, resulting in high confidentiality and integrity impact and low availability impact with a changed scope (OpenBao Advisory). Because OpenBao manages secrets, credentials, and identity-based access controls, token theft can lead to unauthorized access to sensitive secrets, lateral movement within infrastructure, and potential compromise of downstream systems that rely on OpenBao-issued credentials (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.04% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported. Exploitation does require user interaction (the victim must visit the attacker-supplied URL), which somewhat limits opportunistic mass exploitation but does not reduce the risk in targeted phishing scenarios.

1. Identify a target OpenBao instance: Locate an OpenBao deployment (pre-2.5.2) that has at least one JWT/OIDC role configured with callback_mode=direct and is reachable over the network.
2. Initiate an authentication request: Send a request to the OpenBao oidc/auth_url endpoint specifying the vulnerable role and a client_nonce controlled by the attacker. Record the returned auth_url and state parameter.
3. Craft and deliver the phishing URL: Share the auth_url with the victim (e.g., via email, chat, or a malicious web page), enticing them to click it. The URL points to the legitimate OIDC identity provider.
4. Victim authenticates at the identity provider: The victim logs in at the identity provider, which redirects the authorization code back directly to the OpenBao API callback endpoint (/v1/auth/jwt/oidc/callback) — not to a browser-controlled client — because of direct mode.
5. Poll for the issued token: The attacker continuously polls the OpenBao oidc/poll endpoint using the known state and client_nonce values until the victim completes authentication and OpenBao issues a token.
6. Use the stolen token: The attacker uses the obtained OpenBao token to access secrets, policies, and other resources authorized for the victim's identity (OpenBao Advisory, Patch Commit).

• Network: Repeated polling requests to /v1/auth/jwt/oidc/poll from an IP address that differs from the IP that initiated the original auth_url request; unexpected or high-frequency calls to the OIDC callback endpoint (/v1/auth/jwt/oidc/callback) from external or unfamiliar IP addresses.
• Logs: OpenBao audit logs showing a auth_url request and a subsequent callback request originating from different source IPs for the same state value; token issuance events for a user identity where the requester IP recorded at authURL time does not match the IP of the polling client.
• Authentication Events: Successful JWT/OIDC logins via direct callback mode at unusual times or from geographic locations inconsistent with the legitimate user's normal access patterns; token usage immediately after issuance from an IP not associated with the victim.

Upgrade OpenBao to version 2.5.2 or later, which introduces a mandatory confirmation screen for direct callback mode logins requiring explicit user interaction before a token is issued (OpenBao Advisory). If immediate upgrade is not possible, apply one of the following workarounds: (1) remove or reconfigure any roles that have callback_mode=direct, or (2) enforce a confirmation/consent prompt for every session at the OIDC identity provider level for the Client ID used by OpenBao. Organizations that have verified their OIDC provider always presents its own confirmation prompt may also set the new oidc_disable_confirmation=true role parameter after upgrading, but this should be done cautiously (Patch Commit).

The vulnerability was reported by researcher gianklug and published by OpenBao maintainer cipherboy on March 25, 2026 (OpenBao Advisory). The Hacker Wire covered the disclosure, describing it as a "critical remote phishing via JWT/OIDC authentication bypass." openSUSE issued a security announcement for affected packages, and Fedora updates were tracked by Linux-compatible news outlets, indicating broad downstream distribution awareness (GitHub Advisory).