OpenBao's Kerberos authentication method contains a flaw in the GET handler that causes the system to create authentication tokens with only the default policy and TTL, even though these tokens are returned as part of an error response. Because the tokens are not exposed to the requesting client and are hidden within the error message, callers cannot see or use them, yet the tokens persist in storage. Over time, repeated exploitation can lead to an accumulation of unused tokens that consume storage and processing resources, potentially degrading system performance. The vulnerability is categorized under CWE‑770, which notes uncontrolled resource consumption.

This weakness exists in OpenBao releases before 2.5.4. The affected product is OpenBao, an open‑source identity‑based secrets management system. Versions older than 2.5.4 run the vulnerable Kerberos authentication method.

The CVSS score of 5.3 places the issue in the medium severity range, and it is not listed in the CISA KEV catalog. Exploitation is straightforward because the vulnerable GET endpoint and the negotiation header are publicly reachable without authentication. An attacker can repeatedly send requests over the network to create hidden tokens until the system’s resource limits are approached, which makes the attack vector likely network‑based and the effort low. No mitigation other than the vendor fix is possible, so upgrading to v2.5.4 or applying the rate‑limit workaround is required.