Vulnerability · Published Jul 22, 2026 · Assigned by NCSC.ch

CVE-2026-8152Unblu Spark Open Redirect leading to DOM-Based XSS

Critical 9.3

In plain English

A critical-severity open redirect in Unblu Spark from Unblu inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 64.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

Affected products (as reported)

Vendor	Product	Versions
Unblu inc.	Unblu Spark	0 – through 8.36.1

Weakness: CWE-601, CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

Unblu Security Advisories vendor-advisory