CVE-2026-8152: Unblu Spark Open Redirect leading to DOM-Based XSS
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
For on-premises deployments, set com.unblu.identifier.siteEmbeddedSetup to false so Unblu Spark does not run in the same origin as the host application (mitigates the expanded blast radius where injected JavaScript executes with access to host cookies, DOM, and same-origin APIs).
Unblu Spark com.unblu.identifier.siteEmbeddedSetup = false - Configuration
Ensure the redirect filter is configured to restrict user-supplied redirects to the current origin using the defaults (document.location.origin), since Unblu Spark validates all user-supplied redirects through the redirect filter in the listed fix versions.
Unblu Spark redirect filter redirects validation/origin restriction (default) = current origin only (document.location.origin)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8152?
CVE-2026-8152 has a critical severity rating of 9.3 according to the CVSS scoring system.
How do I fix CVE-2026-8152?
To mitigate CVE-2026-8152, ensure that com.unblu.identifier.siteEmbeddedSetup is not set to true during the deployment of Unblu Spark.
What type of attack is associated with CVE-2026-8152?
CVE-2026-8152 is associated with open redirect vulnerabilities that can lead to DOM-based cross-site scripting (XSS) attacks.
What software is affected by CVE-2026-8152?
CVE-2026-8152 affects Unblu Spark software applications.
When was CVE-2026-8152 published?
CVE-2026-8152 was published on July 22, 2026.