---
cve: "CVE-2026-115360"
severity: "MEDIUM"
cvss: 5.3
epss: "0.3%"
vendor: "openbao"
kev: false
exploited: false
published: "2026-10-22 19:17:42"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-27T18:25:17+01:00"
---

# CVE-2026-115360

> 5.3 MEDIUM · 🧪 PoC

## Beschreibung

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-23 21:07:08
- CNA-CVSS: **5.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-601** — URL Redirection to Untrusted Site ('Open Redirect')
  The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

## Angriffsmuster (CAPEC)

- [CAPEC-178 — Cross-Site Flashing](https://capec.mitre.org/data/definitions/178.html) _(Severity: Medium)_

## Patch verfügbar (OSV)

- 63a65e6b907589dbb952c371a70260a065bf8bd7

## Referenzen

- <https://github.com/openbao/openbao/security/advisories/GHSA-2cjw-94fw-wqjx>
- <https://www.vulncheck.com/advisories/openbao-before-2.6.3-open-redirect-via-oidc-identity-provider-ui>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-115360/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_