Critical 9.3Published Jul 22, 2026

CVE-2026-8152Unblu Spark Open Redirect leading to DOM-Based XSS

Updated under an hour ago (Oct 25, 2026, 11:23 PM ET)

Does this affect you?

It affects Unblu inc. Unblu Spark. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Unblu inc. Unblu Spark

Exploited in the last 30 days

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Weakness (CWE): CWE-601, CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: NCSC.ch
NVD analysis: Deferred
Record last updated: Jul 22, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Unblu inc. Unblu Spark unblu:spark (from the name)	through 8.36.1; 8.36.1-hotfix.0 not affected; 8.37.0 not affected	CNA record

References

https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.