CVE-2026-126310
Received Received - Intake

Authentication Bypass in OpenBao via OIDC Token Abuse

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126310
EUVD
EUVD-2026-125210

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openbao openbao to 2.6.5 (exc)
openbao openbao to 2.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenBao before versions 2.6.5 and 2.7.2 has an authentication bypass flaw. Unauthenticated users can obtain OIDC ID tokens by exploiting public clients with enabled client_credentials. Attackers only need a public client's client_id to request tokens from the identity/oidc/provider/<name>/token endpoint and impersonate the client without a secret.

Detection Guidance

To detect this vulnerability, check if OpenBao versions before 2.6.5 or 2.7.2 are running. Verify if any public clients with client_credentials enabled are configured. Inspect logs for unauthorized token requests to the identity/oidc/provider/<name>/token endpoint.

Impact Analysis

This vulnerability allows attackers to impersonate legitimate clients, potentially gaining unauthorized access to sensitive data or systems. It could lead to data breaches, privilege escalation, or unauthorized actions performed under the guise of a trusted client.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to personal or sensitive data, leading to potential breaches of GDPR, HIPAA, or other regulations. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Upgrade OpenBao to version 2.6.5 or 2.7.2 or later. Disable client_credentials for public clients. Restrict access to the OIDC token endpoint. Review and audit client configurations for unauthorized token requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...