https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T11:54:20.704354+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126310 CVE-2026-126310 — OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials 2026-11-14T11:54:20.708314+00:00

Affected: openbao

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.