The vulnerability arises from OpenBao's AppRole authentication method not validating Secret ID expiration upon use. An attacker who possesses an expired Secret ID after the periodic tidy process can authenticate and gain access beyond the intended time‑to‑live. This flaw effectively bypasses authentication controls, enabling unauthorized users to perform any actions allowed by the role associated with the Secret ID.

OpenBao versions prior to 2.6.4 and 2.7.0 prior to 2.7.1 are affected. The impacted product is the OpenBao openbao server. No other vendors or product lines are listed.

With a CVSS score of 2.1 the vulnerability is considered low severity. The EPSS score is unavailable, suggesting no reported exploitation trend, and the issue is not listed in CISA's KEV catalog. The likely attack vector, inferred from the description, is remote authentication using an expired Secret ID; the attacker must first have access to such a key, which can be achieved if the key was compromised or if an audit of unused credentials is not performed. Successful exploitation results in unauthorized authentication but does not directly compromise other security domains such as confidentiality or integrity beyond the compromised role's permissions.