The vulnerability is an open redirect in the OIDC identity provider UI of OpenBao. A crafted OIDC link can cause an unauthenticated user to be redirected to a site controlled by an attacker. This redirects users without their consent and can be used for phishing or credential theft. The weakness corresponds to CWE-601.

Affected systems are installations of OpenBao prior to version 2.6.3. Any user accessing the OIDC identity provider UI while not yet authenticated is susceptible. No further product or version specificity beyond the stated cutoff is documented.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the current risk of exploitation is uncertain but potentially exploitable because the attack does not require authentication. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending a malicious OIDC link to users, prompting them to visit a phishing domain. Mitigation requires patching or restricting redirect destinations.