CVE-2026-8152

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

CVSS

No CVSS.

References

Link	Resource
https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001

Configurations

No configuration.

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Unblu Spark contiene una vulnerabilidad de redirección abierta que puede escalarse a un ataque de cross-site scripting (XSS) basado en DOM. Cuando Unblu Spark se despliega con com.unblu.identifier.siteEmbeddedSetup=true, se ejecuta en el mismo origen que la aplicación anfitriona. Cualquier JavaScript inyectado a través de esta vulnerabilidad, por lo tanto, se ejecuta con acceso total a las cookies, el DOM y las API del mismo origen de la aplicación anfitriona - un atacante puede alcanzar todos los recursos de la aplicación anfitriona, no solo los de Unblu. Este radio de impacto expandido es la razón por la que los despliegues locales que utilizan esta configuración se califican como CRÍTICOS.

Information

Published : 2026-07-22 13:16

Updated : 2026-10-24 17:10

NVD link : CVE-2026-8152

Mitre link : CVE-2026-8152

CVE.ORG link : CVE-2026-8152

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-8152", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8152", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:54:56.321413Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Unblu inc.", "product": "Unblu Spark", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.36.1"}, {"status": "unaffected", "version": "8.36.1-hotfix.0", "versionType": "semver"}, {"status": "unaffected", "version": "8.37.0", "versionType": "semver"}], "platforms": ["On-premises", "Cloud"], "defaultStatus": "affected"}]}], "published": "2026-07-22T13:16:38.423", "references": [{"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL."}, {"lang": "es", "value": "Unblu Spark contiene una vulnerabilidad de redirecci\u00f3n abierta que puede escalarse a un ataque de cross-site scripting (XSS) basado en DOM.\n\nCuando Unblu Spark se despliega con com.unblu.identifier.siteEmbeddedSetup=true, se ejecuta en el mismo origen que la aplicaci\u00f3n anfitriona. Cualquier JavaScript inyectado a trav\u00e9s de esta vulnerabilidad, por lo tanto, se ejecuta con acceso total a las cookies, el DOM y las API del mismo origen de la aplicaci\u00f3n anfitriona - un atacante puede alcanzar todos los recursos de la aplicaci\u00f3n anfitriona, no solo los de Unblu. Este radio de impacto expandido es la raz\u00f3n por la que los despliegues locales que utilizan esta configuraci\u00f3n se califican como CR\u00cdTICOS."}], "lastModified": "2026-10-24T17:10:00.220", "sourceIdentifier": "vulnerability@ncsc.ch"}