CVE-2026-8152 — Unblu Spark Open Redirect leading to DOM-Based XSS

Description (CNA)

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

Affected (CNA)

Vendor / product	Versions
Unblu inc. / Unblu Spark	affected 0 through 8.36.1; unaffected 8.36.1-hotfix.0; unaffected 8.37.0

CWE

CWE-601, CWE-79

References

https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.