Token lifetime extension via certificate identity mismatch

Improper certificate validation in OpenBao before 2.5.3 allows remote authenticated users to renew another certificate-auth token. The pathLoginRenew handler accepts a sibling certificate signed by the same CA because it rejects a renewal only when both key identifiers differ, rather than binding the request to the original certificate and role. Exploitation requires certificate authentication with binding enabled, a sibling certificate and key, and knowledge of the original token or accessor, enabling extension of the original token and its dynamic leases.