CVE-2026-126310
HIGH
NVD
CVSS Score
8.7
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.