The vulnerability arises from an unsanitized error_description parameter displayed on the OIDC authentication error page, which allows attackers to inject arbitrary script that runs in the victim's browser. When the script executes, it can read and exfiltrate the authentication token that the victim uses in the OpenBao web interface, effectively compromising the confidentiality of the victim’s session and enabling unauthorized access to the victim’s secrets.

OpenBao installations with OIDC/JWT authentication enabled and any role configured with callback_mode set to direct are affected. The flaw exists in all releases prior to version 2.5.2; the fix is implemented in v2.5.2 through a static error message that removes the vulnerable parameter.

The CVSS score of 9.4 indicates a high severity. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a currently low exploitation likelihood. Attackers can exploit the reflected XSS by crafting a malicious error_description value and tricking a victim into visiting the resulting error page, causing the attacker’s script to run in the victim’s browser and steal the authentication token.