UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126310

OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials

Severity
High 7.0
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.6.5, 2.7.2
Weakness
Improper authentication (CWE-287)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N
Sources
CVE Program

Description

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider//token endpoint to impersonate the client without any secret.

From the CVE Program.

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cna:openbao|openbao
  • Every version before 2.6.5
  • From 2.7.0 before 2.7.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126310