https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:00:21.826361+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-08726 bdu:2026-08726 2026-10-06T09:00:21.833505+00:00 bdu:2026-08726 https://cve.radiocsirt.org/vuln/bit-openbao-2026-33758 BIT-openbao-2026-33758 — OpenBao has Reflected XSS in its OIDC authentication error message 2026-10-06T09:00:21.833539+00:00

Affected: Bitnami: openbao

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

 https://cve.radiocsirt.org/vuln/euvd-2026-337332 EUVD-2026-337332 2026-10-06T09:00:21.833574+00:00 EUVD-2026-337332 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33758 fkie_cve-2026-33758 2026-10-06T09:00:21.833587+00:00

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

 https://cve.radiocsirt.org/vuln/ghsa-cpj3-3r2f-xj59 GHSA-cpj3-3r2f-xj59 — OpenBao has Reflected XSS in its OIDC authentication error message 2026-10-06T09:00:21.833609+00:00

Affected: Go: github.com/openbao/openbao

### Impact

OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication.

This allows an attacker access to the token used in the Web UI by a victim.

### Patches The `error_description` parameter has been replaced with a static error message in v2.5.2

### Workarounds The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10438-1 openSUSE-SU-2026:10438-1 — openbao-2.5.2-1.1 on GA media 2026-10-06T09:00:21.833633+00:00

openbao-2.5.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0864 WID-SEC-W-2026-0864 — OpenBao: Mehrere Schwachstellen 2026-10-06T09:00:21.833649+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Cross Site Scripting Angriff durchzuführen.