CVE-2026-8152
Unblu Spark has an open redirect flaw that can be turned into a DOM‑based cross‑site scripting (XSS) attack. When the setting com.unblu.identifier.siteEmbeddedSetup=true is enabled, the embedded Spark runs in the same origin as the host application, letting injected JavaScript run with full access to the host’s cookies, DOM, and APIs. This makes the vulnerability especially dangerous for on‑premises deployments.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Unblu Spark on‑premises installations that use the com.unblu.identifier.siteEmbeddedSetup=true configuration. The typical user is an organization that hosts Unblu Spark locally and has enabled this setting.
Real-world impact
An attacker who exploits this flaw can inject malicious JavaScript that runs with the same privileges as the host application. This allows the attacker to read or modify the host’s cookies, steal session tokens, manipulate the page, and access any resources the host can reach, potentially compromising the entire application.
Why this severity
The CVSS score of 9.3 reflects the high likelihood of exploitation (low attack complexity, no authentication required), the severe impact on confidentiality, integrity, and availability, and the fact that the vulnerability can be leveraged to gain full control over the host application’s environment.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources