When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Unblu inc. | Unblu Spark | affected |
|
No data.
No data.
No data available yet.
Vendor Solution
In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter. After upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin).
Vendor Workaround
If you cannot upgrade immediately, either of the following measures prevents exploitation: * Enable the built-in Content Security Policy by setting com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note: this protection is only effective on Unblu Spark 7.56.2 or later in the 7.x series and 8.19.1 or later in the 8.x series, where unsafe-inline was removed from the script source policy. Earlier versions ship a CSP that still permits unsafe-inline and are not protected by this workaround. * Configure a WAF rule to block requests that carry a malicious payload in the redirectOnFailure parameter (in particular, values containing a javascript: scheme or obfuscated variants such as java%0ascript:).
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 22 Jul 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 22 Jul 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL. | |
| Title | Unblu Spark Open Redirect leading to DOM-Based XSS | |
| Weaknesses | CWE-601 CWE-79 |
|
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: NCSC.ch
Published:
Updated: 2026-07-22T18:55:07.732Z
Reserved: 2026-05-08T08:12:13.325Z
Link: CVE-2026-8152
Vulnrichment
Updated: 2026-07-22T18:55:03.407Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.